CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Podatność w ExtremePacs Extreme XDS pozwala na ominięcie autoryzacji poprzez klucz kontrolowany przez użytkownika, co umożliwia zbieranie danych dostarczonych przez użytkowników. Problem dotyczy wersji Extreme XDS przed 3928.
Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Reader (RtsUer.sys) before 10.0.22000.31274 allows for the leakage of kernel memory from both the stack and the heap.
Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Reader (RtsUer.sys) before 10.0.22000.31274 leaks driver logs containing addresses of kernel mode objects, weakening KASLR.
CPython 3.9 and earlier does not disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols(), which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used. This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in practice.
W podatności CVE-2024-1153 występuje niewłaściwa neutralizacja specjalnych elementów używanych w poleceniach SQL, co prowadzi do ataku typu SQL Injection w aplikacjach Talya Informatics Travel APPS. Problem dotyczy wersji przed v17.0.68.
Podatność CVE-2024-4604 dotyczy mechanizmu SSO (Single Sign On) w Magarsus Consultancy, umożliwiając manipulację ukrytymi polami, co prowadzi do przekierowania URL do nieufnych witryn. Problem ten występuje w wersjach od 1.0 do przed 1.1.
Podatność w aplikacji zdrowotnej Mia-Med firmy Mia Technology Inc. polega na użyciu uszkodzonego lub ryzykownego algorytmu kryptograficznego, co umożliwia fałszowanie podpisów z powodu niewłaściwej walidacji. Problem dotyczy wersji aplikacji przed 1.0.14.
Podatność CVE-2024-4754 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w oprogramowaniu Next4Biz CRM i BPM, co pozwala na ataki typu Stored XSS. Problem ten dotyczy wersji Business Process Management (BPM) od 6.6.4.4 do przed 6.6.4.5.
A Cross Site Scripting (XSS) vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via the "sectionContent" parameter in the functionality of adding notes to an uploaded file.
A Cross Site Scripting (XSS) vulnerability in Tessi Docubase Document Management product version 5.x allows a remote attacker to execute arbitrary code via the filename parameter.
A Cross Site Scripting (XSS) vulnerability in Tessi Docubase Document Management product version 5.x allows a remote attacker to execute arbitrary code via the idactivity parameter.
A Cross Site Scripting (XSS) vulnerability in Tessi Docubase Document Management product version 5.x allows a remote attacker to execute arbitrary code via the 'page' parameter.
A spoofing vulnerability in Microsoft Edge (Chromium-based) allows an attacker to falsify content or user interface elements. This flaw can be exploited to display a fake website, impersonating a trusted source.
A spoofing vulnerability in Microsoft Edge (Chromium-based) allows attackers to falsify content or user interface elements. This flaw can be exploited to display deceptive information, potentially leading to fraud or data theft.
A Cross Site Scripting (XSS) vulnerability in Moodle CMS v3.10 allows a remote attacker to execute arbitrary code via the Field Name (name parameter) of a new activity.
A spoofing vulnerability in Microsoft Edge (Chromium-based) allows an attacker to impersonate a trusted website. The flaw stems from improper URL processing, which can lead to a fake address bar being displayed.
A spoofing vulnerability in Microsoft Edge (Chromium-based) allows an attacker to manipulate the user interface, such as the address bar. This can be used to display misleading content, tricking users into believing they are on a legitimate site.
A spoofing vulnerability in Microsoft Edge for iOS allows user interface manipulation, potentially leading to the display of fraudulent content or web pages.
An information disclosure vulnerability in Microsoft Dynamics 365 (On-Premises) allows unauthorized users to access sensitive data. The flaw stems from improper access control management of system resources.
A vulnerability in Azure Identity Libraries and Microsoft Authentication Library (MSAL) allows elevation of privilege. An attacker can exploit this flaw to gain unauthorized access to resources protected by Azure Active Directory.