CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The issue was addressed with improved bounds checks. A remote attacker may be able to break out of Web Content sandbox. Apple is aware of a report that this issue may have been actively exploited.
A use-after-free issue was addressed with improved memory management. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been actively exploited.
XWiki Platform, from version 12.9-rc-1 to 14.4.8, 14.10.6, and 15.1, allows logged-in users to add dangerous content in the first name field, leading to rights escalation. The vulnerability has been fixed in versions 14.4.8, 14.10.6, and 15.1.
XWiki Platform, from version 7.3-milestone-1 to versions 14.4.8, 14.10.6, and 15.1, allows access to obfuscated passwords via REST API, even when email obfuscation is enabled. The issue has been patched in versions 14.4.8, 14.10.6, and 15.1.
XWiki Platform, a popular wiki platform, has a vulnerability that allows users with view rights on documents to execute code with programming rights. Versions from 2.40m-2 up to but not including 14.4.8, 14.10.4, and 15.0 are susceptible to remote code execution via a specially crafted URL.
XWiki Platform has a vulnerability related to email obfuscation configuration. In versions from 3.5-milestone-1 to 14.4.8, 14.10.4, and 15.0-rc-1, server responses contained unobfuscated email addresses, allowing users to read them.
A critical vulnerability was found in SourceCodester Human Resource Management System version 1.0. Manipulation of the employeeid argument in the detailview.php file leads to SQL injection.
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter.
An unauthenticated Time-Based SQL injection was found in Webkul QloApps version 1.6.0 via GET parameters date_from, date_to, and id_product. This allows a remote attacker to bypass the web application's authentication and authorization mechanisms and retrieve the contents of an entire database.
A vulnerability in FastAsyncWorldEdit (FAWE) allows an attacker to select a region using the `Infinity` keyword, enabling any operation to be executed. This could potentially bring the server down.
The XWiki Platform has a vulnerability that allows tags from pages not viewable to the current user to be leaked via the tags API. This information can be exploited to infer the document reference of non-viewable pages.
In XWiki Platform, from version 11.8-rc-1 to 14.4.8, 14.10.6, and 15.2, any logged-in user can edit the `Mail.MailConfig` configuration. This allows them to change the mail obfuscation settings and view and edit mail sending configurations, including the SMTP domain name and credentials.
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie. This enables the attacker to impersonate that user via POST email_create and back parameter.
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via GET configure parameter.
LibreDWG versions 0.11 to 0.12.5 were found to contain a heap buffer overflow in the function bit_write_TF in bits.c.
Version 0.12.5 of LibreDWG was found to contain a heap buffer overflow vulnerability in the function bit_calc_CRC in bits.c.
Versions of LibreDWG from 0.10 to 0.12.5 were found to contain a heap buffer overflow vulnerability in the function bit_utf8_to_TU in bits.c.
LibreDWG versions 0.10 to 0.12.5 were found to contain a heap buffer overflow in the function bit_wcs2nlen at bits.c.
XWiki Platform versions from 2.2.1 to 14.4.8, 14.10.5, and 15.1RC1 are vulnerable to a stored cross-site scripting (XSS) attack. Users can insert HTML code into documents, allowing unauthorized actions to be performed by other users who visit those documents.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS