CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
W czujniku przepływu powietrza SICK FTMg, modele 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526, możliwe jest użycie hasha hasła zamiast rzeczywistego hasła do uwierzytelnienia. To pozwala nieuprzywilejowanemu zdalnemu atakującemu na zalogowanie się do ważnego konta użytkownika za pośrednictwem interfejsu REST.
W czujniku przepływu powietrza SICK FTMg występuje niezgodność w odpowiedziach, co pozwala zdalnemu atakującemu na uzyskanie informacji o ważnych nazwach użytkowników. Problem dotyczy numerów części 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 poprzez analizę odpowiedzi wyzwań z serwera za pośrednictwem interfejsu REST.
W urządzeniach SICK FTMg AIR FLOW SENSOR o numerach części 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 występuje podatność polegająca na ujawnieniu wrażliwych informacji w kodzie źródłowym. Zdalny atakujący może uzyskać informacje o ważnych nazwach użytkowników poprzez analizę kodu źródłowego.
An information disclosure vulnerability in /be/rpc.php in Jedox 2020.2.5 allows remote, authenticated users with permissions to modify database connections to disclose a connection's cleartext password via the 'test connection' function.
An issue in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to access sensitive information via the EXE installer. The vendor notes this is not a separate vulnerability from CVE-2023-29818 and CVE-2023-29819.
An issue in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and earlier allows a local attacker to bypass protections via a crafted payload.
In Webroot SecureAnywhere Endpoint Protection CE 23.1 version 9.0.33.39 and earlier, the default allowlist feature is stored with non-admin privileges. A local attacker can exploit this to bypass the product's protections.
LavaLite CMS version 9.0.0 was found to be vulnerable to a host header injection attack. An attacker can manipulate the Host header in HTTP requests, potentially leading to unauthorized actions.
Cross Site Scripting (XSS) vulnerability in Fetlife rollout-ui version 0.5 allows attackers to execute arbitrary code via a crafted URL in the delete a feature functionality.
Multiple stored cross-site scripting (XSS) vulnerabilities in FICO Origination Manager Decision Module 4.8.1 allow attackers to execute arbitrary web scripts or HTML via a crafted payload.
There is a NULL Pointer Dereference vulnerability in the GitHub repository vim/vim prior to version 9.0.1531.
A Cross-Site Scripting vulnerability was found in Chamilo LMS version 1.11.18. It allows a local attacker to execute arbitrary code via a crafted payload in the personal notes function.
A Cross-Site Scripting (XSS) vulnerability was found in Chamilo LMS version 1.11.18 in the 'My Progress' function. A local attacker can execute arbitrary JavaScript code via a crafted payload.
A Cross Site Scripting vulnerability was found in Chamilo LMS version 1.11.18. It allows a local authenticated attacker to execute arbitrary code via the homepage function.
A Cross-Site Scripting (XSS) vulnerability was found in Chamilo LMS version 1.11.18. A local attacker can exploit the course category parameters to execute arbitrary JavaScript code in the victim's browser.
A Cross Site Scripting (XSS) vulnerability was found in Chamilo LMS version 1.11.18. It allows a local attacker to execute arbitrary code via the resource sequencing parameters.
A Cross-Site Scripting vulnerability was found in Chamilo LMS version 1.11.18. A local attacker can use the skype and linedin_url parameters to execute arbitrary JavaScript code in the victim's browser.
A Cross-Site Scripting (XSS) vulnerability was found in Chamilo LMS version 1.11.18. A local attacker can execute arbitrary JavaScript code via the skills wheel parameter.
A Cross-Site Scripting vulnerability was found in Chamilo LMS version 1.11.18. A local attacker can execute arbitrary JavaScript code via the forum title parameter.
A Cross-Site Scripting (XSS) vulnerability was found in Chamilo LMS version 1.11.18 in the system announcements parameter. It allows a local attacker to execute arbitrary JavaScript code in the victim's browser.