CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
libsixel w wersji 1.8.6 zawiera podatność typu Heap Use After Free, która występuje w pliku libsixel/src/dither.c w linii 388. Może to prowadzić do nieprzewidzianego zachowania aplikacji.
Wersja 1.8.6 biblioteki libsixel jest podatna na przepełnienie bufora w pliku libsixel/src/quant.c w linii 876. Ta podatność może prowadzić do nieautoryzowanego dostępu do pamięci.
libsixel w wersji 1.10.0 jest podatny na błąd 'Use after free' w pliku libsixel/src/dither.c w linii 379. Może to prowadzić do nieprzewidzianego zachowania aplikacji.
A Cross Site Scripting (XSS) vulnerability exists in the Exrick XMall Admin Panel in product-add.jsp. An attacker can inject a malicious script via the GET parameter, leading to JavaScript execution in the victim's browser.
The vulnerability in SUNNY TRIPOWER 5.0 firmware version 3.10.16.R allows unauthorized user groups to access resources due to insecure cookie handling. This is an Insecure Direct Object Reference (IDOR) issue.
The Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 suffers from missing authentication. This means it does not require proper login to access its functions or data.
The Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to transmitting write requests and characters, which may allow an attacker to manipulate device data or functions.
The Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to a Replay Attack during BP monitoring. An attacker can intercept and replay valid requests, leading to unauthorized access or data manipulation.
The Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to plain text command transmission over Bluetooth Low Energy (BLE). This allows an attacker to intercept or send unencrypted commands to the device.
A remote code execution (RCE) vulnerability in baigo CMS v3.0-alpha-2 allows attackers to execute arbitrary code by uploading a crafted PHP file.
The HTTP interface in Synaman version 5.1 and below allows authenticated attackers to execute arbitrary code and escalate privileges.
Synaman version 5.1 and below was found to have weak file permissions, allowing authenticated attackers to escalate privileges.
BigAnt Server v5.6.06 was discovered to contain an incorrect access control issue. This vulnerability may allow unauthorized users to access resources they should not have permissions to.
A use-after-free vulnerability in the Animation component in Google Chrome prior to 98.0.4758.102. A remote attacker can trigger heap corruption via a crafted HTML page.
W repozytorium GitHub yourls/yourls przed wersją 1.8.3 występuje podatność typu Cross-Site Request Forgery (CSRF). Atakujący może wykorzystać tę lukę do wykonania nieautoryzowanych działań w imieniu zalogowanego użytkownika.
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment; applications deployed as Spring Boot executable jars are not vulnerable to this specific exploit, but the vulnerability is more general in nature.
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
A Cross Site Scripting (XSS) vulnerability was found in Chikista Patient Management Software 2.0.2 in the first_name parameter. It affects the following pages: patient/insert, patient_report, appointment_report, visit_report, and bill_detail_report.
Online Banking System Protect v1.0 contains a local file inclusion (LFI) vulnerability via the pages parameter. This allows an attacker to read sensitive files on the server.
A remote code execution (RCE) vulnerability in Online Banking System Protect v1.0 allows attackers to execute arbitrary code via a crafted PHP file uploaded through the Upload Image function.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS