CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.11)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an attacker to execute a cross-site scripting (XSS) attack or an open redirect attack. For more details, see the Details section of the Cisco advisory.
Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an attacker to perform a cross-site scripting (XSS) attack or an open redirect attack.
A vulnerability in Cisco Firepower Threat Defense (FTD) Software allows an authenticated local attacker with administrative privileges to overwrite or append arbitrary data to system files with root privileges. This is due to incomplete validation of user input for a specific CLI command.
Multiple vulnerabilities in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges. For more information, see the Details section of the advisory.
Multiple vulnerabilities in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges. For more information, see the Details section of the advisory.
Multiple vulnerabilities in the payload inspection for Ethernet Industrial Protocol (ENIP) traffic in Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured rules for ENIP traffic. This is due to incomplete processing during deep packet inspection for ENIP packets. An attacker could send a crafted ENIP packet to bypass access control and intrusion policies.
In Oracle PeopleSoft Enterprise CS Campus Community (Notification Framework) versions 9.0 and 9.2, a low-privileged attacker with physical access to the communication segment can gain unauthorized access to critical data or all accessible data.
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in PHPMyWind 5.6, allowing attackers to create a new administrator account without authentication.
rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may successfully download any file on the server.
An XSS vulnerability in Afian FileRun 2021.03.26 allows an attacker to inject malicious scripts when an administrator uses the HTML Editor to preview or edit a crafted document.
An SSRF vulnerability in NagiosXI up to version 5.8.4 allows authenticated users to create scheduled reports with PDF screenshots of any view. Lack of input sanitization enables replacing the target page with an SSRF payload.
Afian FileRun 2021.03.26 is vulnerable to stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs. An attacker can inject malicious JavaScript code.
JIZHICMS 1.5.1 contains a cross-site scripting (XSS) vulnerability in the /user/release.html component, allowing attackers to arbitrarily add an administrator cookie.
W Kubernetes odkryto problem bezpieczeństwa, który pozwala aktorom kontrolującym odpowiedzi na żądania MutatingWebhookConfiguration lub ValidatingWebhookConfiguration na przekierowanie żądań kube-apiserver do prywatnych sieci apiservera. Użytkownik, który ma dostęp do logów kube-apiserver przy poziomie logowania ustawionym na 10, może zobaczyć przekierowane odpowiedzi i nagłówki w logach.
Information disclosure vulnerability in Microsoft Accessibility Insights for Android. Could allow an attacker to access sensitive data.
Cross-site scripting (XSS) vulnerability in Microsoft Dynamics Business Central. Allows injection of malicious script into the application.
Tampering vulnerability in Microsoft Edge (Chromium-based). Could allow modification of browser data or behavior.
Information Disclosure vulnerability in Microsoft Office Graphics Component. Could allow an attacker to read data from memory.
Information Disclosure vulnerability in Windows Storage. Could allow an attacker to read data from memory.
Information disclosure vulnerability in the Windows Redirected Drive Buffering SubSystem driver. It may allow an attacker to read data they should not have access to.