CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple reflected XSS vulnerabilities were found in nasSvr.php of actiNAS-SL-2U-8 version 3.2.03-SP1. They allow remote attackers to inject arbitrary web script or HTML.
A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel's SCTP subsystem. Guests with local user privileges can trigger a deadlock and potentially crash the system.
A Cross-Site Scripting (XSS) vulnerability was found in ABO.CMS version 5.9.3. The flaw allows an attacker to execute arbitrary JavaScript code via a crafted Referer header.
In the Linux kernel, the blkgs destruction path in block/blk-cgroup.c causes a cgroup blkio memory leak. A circular dependency prevents freeing blkcg and blkgs after they are offline, potentially leading to system instability like out-of-memory errors.
The vulnerability in the Hozard alarm system v1.0 involves sending an identical radio frequency signal for each request, allowing an attacker to perform replay attacks and disarm the alarm.
A Stored XSS vulnerability in the Email Encoder plugin for WordPress (up to version 2.1.9) via the eeb_mailto shortcode. Due to insufficient input sanitization and output escaping on user-supplied attributes, authenticated attackers with contributor-level permissions or higher can inject arbitrary web scripts that execute whenever a user accesses an injected page.
A stored cross-site scripting (XSS) vulnerability in Infoblox NIOS v8.5.2-409296 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the VLAN View Name field.
A Cross-Site Scripting (XSS) vulnerability was found in NetScout nGeniusOne version 6.3.4. It allows a remote attacker to execute arbitrary code via the 'name' parameter on the Profile and Exclusion List pages.
A Cross-Site Scripting (XSS) vulnerability was found in NetScout nGeniusOne version 6.3.4. It allows a remote attacker to execute arbitrary code via the 'creator' parameter on the Alert Configuration page.
A vulnerability in httparty before version 0.21.0 allows an attacker to manipulate filenames during multipart/form-data uploads. A remote, unauthenticated attacker can provide a crafted filename parameter, leading to the writing of attacker-controlled filenames.
Cross-site scripting vulnerability in govuk_tech_docs versions 2.0.2 through before 3.3.1. Malicious JavaScript may be executed in the user's browser when a crafted search result is displayed.
Stored XSS vulnerability in TinyMCE before version 5.6.0. An unauthenticated remote attacker can inject crafted HTML into the editor, leading to arbitrary JavaScript execution in another user's browser.
An XSS vulnerability in TinyMCE before version 5.10.0 allows a remote, unauthenticated attacker to inject malicious JavaScript via crafted image or link URLs. The code executes in the browser of a user editing content.
Stored XSS vulnerability in TinyMCE before version 5.9.0. An unauthenticated remote attacker can inject crafted HTML into the editor, leading to arbitrary JavaScript execution in another user's browser.
A cross-site scripting (XSS) vulnerability exists in the admin_ Video.php component of SeaCMS v12.8. It allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
In ssh-agent in OpenSSH before 9.6, destination constraints can be incompletely applied when adding PKCS#11-hosted private keys. Constraints are only applied to the first key, even if the PKCS#11 token returns multiple keys.
The 'Create a Space' feature in Silverpeas Core 6.3.1 is reserved for administrators but suffers from broken access control, allowing any authenticated user to create a space by navigating to the correct URL.
A vulnerability in Silverpeas Core 6.3.1 administrative 'Bin' feature allows a low-privileged user to access the bin, revealing all deleted spaces. The user can then restore or permanently delete these spaces.
Silverpeas Core 6.3.1 is vulnerable to Cross Site Scripting (XSS) via the message/notification feature. An attacker can inject malicious JavaScript code into message content.
Silverpeas Core 6.3.1 has an incorrect access control vulnerability in the 'Porlet Deployer' component, allowing administrators to deploy .WAR portlets. This could lead to unauthorized code execution or privilege escalation.