CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.10)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Cross-site scripting (XSS) vulnerability in client.inc.php in osTicket before 1.9.5.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
Cross-site scripting (XSS) vulnerability in upload/scp/tickets.php in osTicket before 1.9.5. Remote attackers can inject arbitrary web script or HTML via the status parameter in a search action.
Multiple cross-site scripting (XSS) vulnerabilities in osTicket before 1.9.2 allow remote attackers to inject arbitrary web script or HTML via the Phone Number field in open.php or the passwd1, passwd2 fields and do parameter in account.php.
W ssh-keysign w OpenSSH przed wersją 5.8p2 na niektórych platformach, występuje problem z niezamierzonymi otwartymi deskryptorami plików, co prowadzi do wykonania ssh-rand-helper. To umożliwia lokalnym użytkownikom uzyskanie wrażliwych informacji o kluczach za pomocą wywołania systemowego ptrace.
A flaw in OpenStack Keystone allows a remote attacker to send a large HTTP request with a long tenant name when requesting a token, leading to excessive CPU and memory consumption and denial of service.
Mechanizm uwierzytelniania hasłem serwera WWW używany przez produkty jest podatny na ataki typu MitM oraz Replay. Skuteczne wykorzystanie tej podatności umożliwia nieautoryzowany dostęp do serwera WWW produktu, co pozwala na przeglądanie i modyfikowanie informacji o konfiguracji i diagnostyce produktu.
Buffer overflow vulnerability in an unspecified ActiveX control in aipgctl.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue. A remote attacker can cause a denial of service via a crafted HTML document.
An unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to modify files via calls to unknown methods.
A directory traversal vulnerability in osTicket 1.6 allows remote attackers to read arbitrary files via a '..' sequence in the file parameter to module.php, a different vector than CVE-2005-1439. This issue has been disputed by a reliable third party.
An unspecified vulnerability in BlazeDS 3.2 and earlier, used in LiveCycle, LiveCycle Data Services, Flex Data Services, and ColdFusion, allows remote attackers to obtain sensitive information via injected tags and external entity references in XML documents.
The updatePosition function in libexpat (Expat 2.0.1) has a buffer over-read vulnerability. Crafted UTF-8 sequences in an XML document can cause an application crash.
Multiple CSRF vulnerabilities in the HTTP Administration component of Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands. The attack involves requests to the /level/15/exec/- URI with the "show privilege" command and to the /level/15/exec/-/configure/http URI with the "alias exec" command.
Multiple cross-site scripting (XSS) vulnerabilities in osTicket allow remote attackers to inject arbitrary web script or HTML via the t, osticket_title, em, e, err parameters and the name and subject fields when adding a ticket.
The ICQwebmail client for ICQ 2000A creates a world-readable temporary file during login and does not delete it, allowing local users to obtain sensitive information.
Check Point Firewall-1 allows remote attackers to cause a denial of service by sending a large number of malformed fragmented IP packets.
Buffer overflow in the web interface for Cmail 2.4.7 allows remote attackers to cause a denial of service by sending a large user name to the user dialog running on port 8002.
Microsoft Outlook and Outlook Express allow remote attackers to cause a denial of service by sending email messages with blank fields such as BCC, Reply-To, Return-Path, or From.
Savant web server allows remote attackers to read source code of CGI scripts via a GET request that does not include the HTTP version number.
Windows NT and Windows 2000 allow a remote attacker to cause a denial of service via malformed DCE/RPC SMBwriteX requests that contain an invalid data length.
PassWD 1.2 uses weak encryption (trivial encoding) to store passwords, allowing an attacker with access to the password file to easily decrypt the passwords.