CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In Teradici PCoIP Management Console-Enterprise 20.07.0, an unauthenticated user can inject arbitrary text into the victim's browser via the web application.
In MISP before version 2.4.146, there is a stored XSS vulnerability in the sharing groups view located in app/View/SharingGroups/view.ctp.
An XSS vulnerability in Chevereto before version 3.17.1 allows an attacker to inject malicious script via the image title during file upload.
A stored cross-site scripting (XSS) vulnerability was discovered in the TrippLite SU2200RTXL2Ua firmware version 12.04.0055 in the /Forms/device_vars_1 script. It allows authenticated attackers to inject malicious scripts via a crafted POST request, leading to theft of other users' data.
A Cross-Site Scripting (XSS) vulnerability was found in Typesetter 5.1 via the className and Description fields in index.php/Admin/Classes. An attacker can inject malicious JavaScript code that executes in the victim's browser.
A Cross Site Scripting (XSS) vulnerability was found in MetInfo 7.0.0 via the gourl parameter in login.php. It allows injection of malicious JavaScript code into the login page.
D-Link DIR-2640-US router version 1.01B04 stores the system account password in plain text. It does not use Linux user management, and all devices share the same unchangeable password. An attacker can easily log in via the serial port and gain root privileges.
A vulnerability in SafeNet KeySecure Management Console 8.12.0 allows HTTP response splitting attacks. A remote attacker can exploit a specially crafted URL to cause the server to return a split response when the URL is clicked.
A CWE-552 vulnerability in Easergy T300 firmware versions V2.7.1 and older allows unauthorized attackers to access system files and directories. Lack of proper access restrictions can lead to exposure of sensitive data.
W urządzeniach PowerLogic PM55xx, PM8ECC, EGX100 i EGX300 występuje podatność CWE-287: Niewłaściwa autoryzacja, która może prowadzić do utraty łączności z urządzeniem za pośrednictwem protokołu Modbus TCP, gdy atakujący wyśle specjalnie przygotowane żądanie HTTP.
Cross-site scripting (XSS) vulnerability in the Portal Workflow module's edit process page in Liferay DXP. Allows remote attackers to inject arbitrary web script or HTML via the currentURL parameter.
In vFairs 3.3, any logged-in user can modify any other user's profile to inject malicious JavaScript (XSS). The database stores HTML tags that are rendered on the page, enabling XSS attacks.
vFairs 3.3 is affected by insecure permissions, allowing any logged-in user to modify other users' profile information or pictures. By knowing a user's unique ID, an attacker can send an HTTP POST request to change profile details or upload a new image.
Centreon version 20.10.2 is affected by a stored XSS vulnerability. The dep_description and dep_name parameters are vulnerable to script injection, requiring login and navigation to Configuration > Notifications > Hosts.
W Arm Trusted Firmware M do wersji 1.2, świat NS może wywołać zatrzymanie systemu, nadpisanie danych zabezpieczonych lub wydrukowanie danych zabezpieczonych podczas wywoływania funkcji zabezpieczonych w trybie obsługi NSPE.
A stored cross-site scripting (XSS) vulnerability was found in the LuCI web interface for OpenWRT version 19.07. It allows an attacker to inject arbitrary JavaScript via the Hostname change operation.
The LuCI web interface for OpenWRT version 19.07 and lower has been found to have a cross-site scripting (XSS) vulnerability.
BMC Remedy Mid Tier 9.1SP3 is affected by a DOM-based cross-site scripting (XSS) vulnerability in a legacy utility. This allows an attacker to inject malicious client-side scripts.
BMC Remedy Mid Tier 9.1SP3 is affected by log hijacking. Remote logging can be accessed by unauthenticated users, allowing an attacker to hijack system logs. This data can include user names and HTTP data.
A memory leak vulnerability was discovered in GNU LibreDWG version 0.10 in the dwg_decode_eed function at decode.c:3638. Crafted input can cause a memory leak, potentially leading to resource exhaustion.