CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.11)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Security feature bypass vulnerability in Windows Security Account Manager Remote Protocol. Could allow bypassing authentication security.
Denial of service vulnerability in Windows Hyper-V. Could allow disruption of virtualization services.
A spoofing vulnerability in Microsoft Bing Search allows an attacker to impersonate a trusted resource or user. Exploitation could lead to tricking users and disclosing sensitive information.
Denial of service vulnerability in Windows DNS Server. Could allow disruption of DNS services.
A vulnerability in Windows Secure Kernel Mode allows a security feature bypass. An attacker could exploit this flaw to bypass kernel protection mechanisms.
A vulnerability in Windows InstallService allows elevation of privilege. An attacker could exploit this flaw to gain higher privileges on the system.
A Cross-Site Scripting (XSS) vulnerability was found in PbootCMS version 2.0.3 in the admin.php file. It allows an attacker to inject malicious JavaScript code into the admin panel.
A cross-site request forgery (CSRF) vulnerability was found in XYHCMS V3.6 at the URI /xyhai.php?s=/Auth/editUser. It allows an attacker to modify administrator information, including name, email, and password.
A cross-site scripting (XSS) vulnerability was found in baigo CMS v4.0-beta-1. Attackers can inject arbitrary JavaScript or HTML code via the 'post' parameter sent to /public/console/profile/info-submit/.
In Teradici PCoIP Management Console-Enterprise 20.07.0, an unauthenticated user can inject arbitrary text into the victim's browser via the web application.
In MISP before version 2.4.146, there is a stored XSS vulnerability in the sharing groups view located in app/View/SharingGroups/view.ctp.
An XSS vulnerability in Chevereto before version 3.17.1 allows an attacker to inject malicious script via the image title during file upload.
A stored cross-site scripting (XSS) vulnerability was discovered in the TrippLite SU2200RTXL2Ua firmware version 12.04.0055 in the /Forms/device_vars_1 script. It allows authenticated attackers to inject malicious scripts via a crafted POST request, leading to theft of other users' data.
A Cross-Site Scripting (XSS) vulnerability was found in Typesetter 5.1 via the className and Description fields in index.php/Admin/Classes. An attacker can inject malicious JavaScript code that executes in the victim's browser.
A Cross Site Scripting (XSS) vulnerability was found in MetInfo 7.0.0 via the gourl parameter in login.php. It allows injection of malicious JavaScript code into the login page.
D-Link DIR-2640-US router version 1.01B04 stores the system account password in plain text. It does not use Linux user management, and all devices share the same unchangeable password. An attacker can easily log in via the serial port and gain root privileges.
In InsydeH2O 5.x, certain SMM drivers did not correctly validate CommBuffer and CommBufferSize parameters, allowing callers to corrupt firmware or OS memory. Affected drivers include AhciBusDxe, IdeBusDxe, NvmExpressDxe, SdHostDriverDxe, and SdMmcDeviceDxe.
A vulnerability in SafeNet KeySecure Management Console 8.12.0 allows HTTP response splitting attacks. A remote attacker can exploit a specially crafted URL to cause the server to return a split response when the URL is clicked.
A CWE-552 vulnerability in Easergy T300 firmware versions V2.7.1 and older allows unauthorized attackers to access system files and directories. Lack of proper access restrictions can lead to exposure of sensitive data.
W urządzeniach PowerLogic PM55xx, PM8ECC, EGX100 i EGX300 występuje podatność CWE-287: Niewłaściwa autoryzacja, która może prowadzić do utraty łączności z urządzeniem za pośrednictwem protokołu Modbus TCP, gdy atakujący wyśle specjalnie przygotowane żądanie HTTP.