CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An issue in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to access sensitive information via the EXE installer. The vendor notes this is not a separate vulnerability from CVE-2023-29818 and CVE-2023-29819.
An issue in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and earlier allows a local attacker to bypass protections via a crafted payload.
In Webroot SecureAnywhere Endpoint Protection CE 23.1 version 9.0.33.39 and earlier, the default allowlist feature is stored with non-admin privileges. A local attacker can exploit this to bypass the product's protections.
LavaLite CMS version 9.0.0 was found to be vulnerable to a host header injection attack. An attacker can manipulate the Host header in HTTP requests, potentially leading to unauthorized actions.
Cross Site Scripting (XSS) vulnerability in Fetlife rollout-ui version 0.5 allows attackers to execute arbitrary code via a crafted URL in the delete a feature functionality.
Medical Systems Co. Medisys Weblab Products v19.4.03 contains a SQL injection vulnerability. The flaw exists in the WSDL files via the tem:statement parameter.
An integer overflow or wraparound exists in the GitHub repository vim/vim prior to version 9.0.1532.
Multiple stored cross-site scripting (XSS) vulnerabilities in FICO Origination Manager Decision Module 4.8.1 allow attackers to execute arbitrary web scripts or HTML via a crafted payload.
A session takeover vulnerability exists in FICO Origination Manager Decision Module 4.8.1 due to insufficient protection of the JSESSIONID cookie.
There is a NULL Pointer Dereference vulnerability in the GitHub repository vim/vim prior to version 9.0.1531.
Win32k Elevation of Privilege Vulnerability.
A vulnerability in Microsoft Word allows for a security feature bypass, potentially leading to unauthorized access to user data.
Microsoft SharePoint Server Remote Code Execution Vulnerability.
A Cross-Site Scripting vulnerability was found in Chamilo LMS version 1.11.18. It allows a local attacker to execute arbitrary code via a crafted payload in the personal notes function.
A Cross-Site Scripting (XSS) vulnerability was found in Chamilo LMS version 1.11.18 in the 'My Progress' function. A local attacker can execute arbitrary JavaScript code via a crafted payload.
A Cross Site Scripting vulnerability was found in Chamilo LMS version 1.11.18. It allows a local authenticated attacker to execute arbitrary code via the homepage function.
A Cross-Site Scripting (XSS) vulnerability was found in Chamilo LMS version 1.11.18. A local attacker can exploit the course category parameters to execute arbitrary JavaScript code in the victim's browser.
A Cross Site Scripting (XSS) vulnerability was found in Chamilo LMS version 1.11.18. It allows a local attacker to execute arbitrary code via the resource sequencing parameters.
A Cross-Site Scripting vulnerability was found in Chamilo LMS version 1.11.18. A local attacker can use the skype and linedin_url parameters to execute arbitrary JavaScript code in the victim's browser.
A Cross-Site Scripting (XSS) vulnerability was found in Chamilo LMS version 1.11.18. A local attacker can execute arbitrary JavaScript code via the skills wheel parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS