CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In Deno version 1.34.0 and deno_runtime 0.114.0, there is a vulnerability that allows unauthorized outbound HTTP requests as they are not checked against the network permission allow list. Users of Deno versions prior to 1.34.0 and Deno Deploy users are unaffected.
In versions prior to 1.4.16, the metachain in the mx-chain-go implementation incorrectly processed transactions with an invalid username, which could lead to the halting of block notarization from shards.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository mkucej/i-librarian-free prior to version 5.10.4, allowing for the storage of malicious code.
A reflected Cross-site Scripting (XSS) vulnerability exists in the GitHub repository mkucej/i-librarian-free prior to version 5.10.4.
A critical vulnerability was found in the Lost and Found Information System version 1.0, affecting unknown code in the file /admin/?page=user/list. Manipulation of this code leads to improper access controls.
A vulnerability was found in SourceCodester Lost and Found Information System 1.0 that allows basic cross site scripting attacks through manipulation of the First Name/Middle Name/Last Name arguments on the Manage User Page.
A vulnerability was found in yiwent Vip Video Analysis 1.0, affecting some unknown functionality of the file admin/admincore.php. The manipulation leads to cross site scripting (XSS) attacks that can be launched remotely.
A critical vulnerability has been found in yiwent Vip Video Analysis 1.0, concerning an unknown functionality of the file data/title.php. Manipulation of the argument titurl leads to server-side request forgery.
A vulnerability was found in BeipyVideoResolution up to version 2.6, allowing cross site scripting attacks through manipulation in an unknown function of the file admin/admincore.php.
An unchecked return value issue exists in the GitHub repository gpac/gpac prior to version 2.2.2.
There is a NULL Pointer Dereference bug in the GitHub repository gpac/gpac prior to version 2.2.2.
In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability was present on the GitLab Connection page.
In JetBrains TeamCity versions before 2023.05, authentication checks were missing – 2FA was not checked for some sensitive account actions.
In JetBrains TeamCity before version 2023.05, a specific endpoint was vulnerable to brute force attacks.
In JetBrains TeamCity versions before 2023.05, a reflected XSS vulnerability was present on the Subscriptions page.
In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability was present in the NuGet feed page.
In JetBrains TeamCity versions before 2023.05, an open redirect vulnerability during oAuth configuration was present.
In JetBrains TeamCity before version 2023.05, 'password' type parameters from build dependencies could be logged in some cases.
In JetBrains TeamCity before version 2023.05, an XSS vulnerability was possible in the Plugin Vendor URL.
In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability existed on the 'Show Connection' page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS