CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.11)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Spoofing vulnerability in Windows Authenticode. An attacker could forge digital signatures, potentially leading to execution of unauthorized software as trusted.
A vulnerability in Windows Installer allows spoofing. An attacker could exploit this flaw to impersonate a trusted source.
Information disclosure vulnerability in Windows Key Distribution Center (KDC). An attacker could exploit this flaw to obtain information that should be protected.
Information disclosure vulnerability in the Windows Remote Access Connection Manager. It may allow an attacker to access information that should be protected.
Information Disclosure vulnerability in Media Foundation. Could allow an attacker to read data from memory.
Security feature bypass vulnerability in Windows Security Account Manager Remote Protocol. Could allow bypassing authentication security.
Denial of service vulnerability in Windows Hyper-V. Could allow disruption of virtualization services.
A spoofing vulnerability in Microsoft Bing Search allows an attacker to impersonate a trusted resource or user. Exploitation could lead to tricking users and disclosing sensitive information.
Denial of service vulnerability in Windows DNS Server. Could allow disruption of DNS services.
A vulnerability in Windows Secure Kernel Mode allows a security feature bypass. An attacker could exploit this flaw to bypass kernel protection mechanisms.
A vulnerability in Windows InstallService allows elevation of privilege. An attacker could exploit this flaw to gain higher privileges on the system.
A Cross-Site Scripting (XSS) vulnerability was found in PbootCMS version 2.0.3 in the admin.php file. It allows an attacker to inject malicious JavaScript code into the admin panel.
A cross-site request forgery (CSRF) vulnerability was found in XYHCMS V3.6 at the URI /xyhai.php?s=/Auth/editUser. It allows an attacker to modify administrator information, including name, email, and password.
A cross-site scripting (XSS) vulnerability was found in baigo CMS v4.0-beta-1. Attackers can inject arbitrary JavaScript or HTML code via the 'post' parameter sent to /public/console/profile/info-submit/.
In Teradici PCoIP Management Console-Enterprise 20.07.0, an unauthenticated user can inject arbitrary text into the victim's browser via the web application.
In MISP before version 2.4.146, there is a stored XSS vulnerability in the sharing groups view located in app/View/SharingGroups/view.ctp.
An XSS vulnerability in Chevereto before version 3.17.1 allows an attacker to inject malicious script via the image title during file upload.
A stored cross-site scripting (XSS) vulnerability was discovered in the TrippLite SU2200RTXL2Ua firmware version 12.04.0055 in the /Forms/device_vars_1 script. It allows authenticated attackers to inject malicious scripts via a crafted POST request, leading to theft of other users' data.
A Cross-Site Scripting (XSS) vulnerability was found in Typesetter 5.1 via the className and Description fields in index.php/Admin/Classes. An attacker can inject malicious JavaScript code that executes in the victim's browser.
A Cross Site Scripting (XSS) vulnerability was found in MetInfo 7.0.0 via the gourl parameter in login.php. It allows injection of malicious JavaScript code into the login page.