CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An SSRF vulnerability in MicroStrategy Web SDK 11.1 and earlier allows unauthenticated remote attackers to perform server-side request forgery via the srcURL parameter in the shortURL task.
If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.
Klient bezpieczeństwa punktów końcowych Check Point dla systemu Windows w wersjach wcześniejszych niż E86.40 kopiuje pliki do raportów kryminalistycznych z katalogu o niskich uprawnieniach. Atakujący może zastąpić te pliki złośliwą lub powiązaną zawartością.
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier. A remote unauthenticated attacker can execute arbitrary code via the fileToUpload parameter in the uploadFile task.
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK version 10.11 and earlier. A remote unauthenticated attacker can execute arbitrary code via the searchString parameter in the wikiScrapper task.
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier allows remote unauthenticated attackers to execute arbitrary code via the 'key' parameter in the getESRIExtraConfig task.
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier allows remote unauthenticated attackers to execute arbitrary JavaScript code via the 'key' parameter in the getGoogleExtraConfig task.
SolarView Compact version 6.00 was found to contain a command injection vulnerability via conf_mail.php. An attacker can exploit this to execute arbitrary system commands on the device.
A OS command injection vulnerability exists in the CGI program of Zyxel USG FLEX, ATP, and VPN series firmware. It allows an attacker to modify specific files and execute OS commands on the vulnerable device. Affected versions include USG FLEX 100(W) 5.00-5.21 Patch 1, USG FLEX 200, 500, 700, USG FLEX 50(W), USG20(W)-VPN, ATP, and VPN series.
W repozytorium GitHub eventsource/eventsource przed wersją v2.0.2 występuje niewłaściwe usuwanie wrażliwych informacji przed ich przechowaniem lub transferem. Może to prowadzić do ujawnienia danych, które powinny być chronione.
Home Owners Collection Management v1 was found to have a reflected XSS vulnerability in the Admin panel via the $_GET['page'] parameter. An attacker can inject malicious script.
Home Owners Collection Management v1 was found to have a reflected XSS vulnerability in the Admin panel via the $_GET['s'] parameter. An attacker can inject malicious script.
An issue was found in Bludit v3.13.0 where an unsafe implementation of the backup plugin allows attackers to upload arbitrary files to the server.
A vulnerability in .NET and Visual Studio allows for a Denial of Service (DoS) attack, potentially leading to application or service unavailability. An attacker can exploit this flaw to disrupt system operations.
.NET and Visual Studio contain a Denial of Service (DoS) vulnerability that can lead to application unavailability.
A vulnerability in Microsoft Excel allows for remote code execution, potentially leading to unauthorized access to the user's system. An attacker can exploit this flaw to run malicious software on the infected device.
A vulnerability in the Windows Address Book allows for remote code execution. An attacker can exploit this flaw to gain control over the victim's system.
A spoofing vulnerability in the Windows LSA service. An attacker can force a domain controller to authenticate to a malicious server.
A privilege elevation vulnerability in Active Directory Domain Services (AD DS). An attacker can gain domain administrator privileges.
Wtyczka RSVPMaker dla WordPressa jest podatna na nieautoryzowaną injekcję SQL z powodu braku odpowiedniego zabezpieczenia i parametryzacji danych dostarczanych przez użytkowników w pliku rsvpmaker-api-endpoints.php. Umożliwia to nieautoryzowanym atakującym kradzież wrażliwych informacji z bazy danych w wersjach do 9.2.6 włącznie.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS