CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A cross-site scripting vulnerability exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.
A cross-site scripting vulnerability exists in PC-HELPER Wireless I/O DIO-0404RY-LWF and DIO-0404RY-LWF-US. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.
A cross-site scripting vulnerability exists in CPSL-08P1EN. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.
An insufficiently protected credentials issue exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*. If this vulnerability is exploited, sensitive information may be restored from a backup file.
A stack-based buffer overflow vulnerability exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*. Receiving a specially crafted request created and sent by a remote attacker may cause a denial-of-service (DoS) condition.
A missing authentication for critical function vulnerability exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*. An attacker may execute a REST API without authentication, which could allow the attacker to retrieve I/O values and/or control the output.
A plaintext storage of a password issue exists in CONPROSYS nano Series. An attacker with physical access to the product may obtain credentials.
An out-of-bounds write vulnerability exists in CONPROSYS nano Series. Receiving a specially crafted request created and sent by a remote attacker may cause a denial-of-service (DoS) condition.
A cross-site scripting vulnerability exists in CONPROSYS nano Series. If exploited, an arbitrary script may be executed on a logged-in user's web browser.
An exposure of information through directory listing issue exists in CONPROSYS PAC Series. Accessing a specific URL may allow a remote unauthenticated attacker to obtain the directory list without authentication.
A cross-site scripting vulnerability exists in CONPROSYS PAC Series. If exploited, an arbitrary script may be executed on a logged-in user's web browser.
An exposure of information through directory listing issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. Accessing a specific URL may allow a remote unauthenticated attacker to obtain the directory list without authentication.
A cross-site scripting vulnerability exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. If exploited, an arbitrary script may be executed in a logged-in user's web browser.
A cross-site scripting vulnerability exists in Contec EC1000 series. If exploited, an arbitrary script may be executed in a logged-in user's web browser.
A cross-site scripting vulnerability exists in Contec RP-WAH-SR Series. If exploited, an arbitrary script may be executed in a logged-in user's web browser.
A cross-site scripting vulnerability exists in SGA1000. If exploited, an arbitrary script may be executed in a logged-in user's web browser.
A cross-site request forgery vulnerability exists in multiple Contec products. If a user views a specially crafted page while logged in to the affected product, unintended operations may be performed.
A cross-site scripting vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series. If exploited, an arbitrary script may be executed in a logged-in user's web browser.
An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2. For a Special:MassMessage?uselang=x-xss URL, the i18n key massmessage-form-page-help allows XSS.
Frappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS