CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.11)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A Cross Site Scripting (XSS) vulnerability in the Beetel router 777VR1 can be exploited via the NTP server name in System Time and the "Keyword" field in URL Filter.
Atakujący może wysłać specjalnie przygotowaną wiadomość do Crimson 3.1 (wersje kompilacji przed 3119.001), co może prowadzić do wycieku dowolnych lokalizacji pamięci.
EGavilanMedia User Registration and Login System With Admin Panel 1.0 is vulnerable to cross-site scripting (XSS) in the Admin Profile Page. An attacker can inject a malicious JavaScript payload into the 'Admin Full Name' field, which triggers every time the admin visits the profile page.
EGavilanMedia User Registration and Login System With Admin Panel 1.0 is vulnerable to cross-site scripting (XSS) in the Admin Panel - Manage User tab via the Full Name field. An attacker can inject a malicious JavaScript payload during user registration, which triggers when the admin visits the manage user section, potentially stealing session cookies.
Invision Community 4.5.4 is affected by a cross-site scripting (XSS) vulnerability in the Field Name field. An attacker can inject a malicious JavaScript payload that executes whenever a user opens that field.
WonderCMS 3.1.3 is vulnerable to cross-site scripting (XSS) in the Admin Panel. An attacker can inject a malicious JavaScript payload in the Page keywords field, which triggers on every visit to the website, allowing theft of session cookies.
CoasterCMS version 5.8.18 is vulnerable to Cross-Site Scripting (XSS). An attacker can steal a user's session cookie and redirect them to a malicious website, as the vulnerability is triggered on the main home page of the application.
DotCMS Add Template with admin panel 20.11 is affected by stored Cross-Site Scripting (XSS) that allows an attacker to steal cookies and gain remote privileges. This compromises the security of the web application.
In OpenAsset Digital Asset Management (DAM) version 12.0.19 and earlier, access controls are missing on the /Stream/ProjectsCSV endpoint, allowing unauthenticated attackers to access potentially sensitive project information stored by the application.
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not properly sanitize user-supplied input in multiple parameters and endpoints, allowing for reflected cross-site scripting (XSS) attacks.
OpenAsset Digital Asset Management (DAM) through version 12.0.19 fails to properly sanitize user-supplied input in multiple parameters and endpoints, allowing stored cross-site scripting (XSS) attacks.
Typ GeneralName w X.509 jest używany do reprezentowania różnych typów nazw, w tym EDIPartyName. Funkcja GENERAL_NAME_cmp w OpenSSL porównuje instancje GENERAL_NAME, ale w przypadku EDIPARTYNAME może prowadzić do dereferencji wskaźnika NULL i awarii, co może skutkować atakiem typu denial of service.
A Cross-Site Scripting (XSS) vulnerability was discovered in SeedDMS 6.0.13 via the folderid parameter in views/bootstrap/class.DropFolderChooser.php. An attacker can inject malicious JavaScript code that executes in the victim's browser.
MISP version 2.4.135 has an XSS vulnerability in the authkey comment field in the genericField.ctp file.
W jądrze Linuxa przed wersją 5.6.8 odkryto problem związany z funkcją do_madvise w pliku mm/madvise.c. Występuje warunek wyścigu pomiędzy operacjami coredump a implementacją IORING_OP_MADVISE.
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker can inject malicious JavaScript code, leading to stored/blind XSS in the admin panel.
In Crafter CMS Crafter Studio 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative data.
An SSRF vulnerability in PDF generation in MicroStrategy 10.4, 2019 before Update 6, and 2020 before Update 2 allows authenticated users to access internal network resources or leak files from the local system via HTML containers embedded in a dossier/dashboard document. Version 10.4 will not receive a fix as it reaches end-of-life on 31/12/2020.
W Modicon M221 (wszystkie wersje) występuje podatność CWE-200, która umożliwia ujawnienie niepoufnych informacji. Atakujący może wykorzystać tę lukę, przechwytując ruch między oprogramowaniem EcoStruxure Machine - Basic a kontrolerem Modicon M221.
W Modicon M221 (wszystkie wersje) występuje podatność CWE-311: Brak szyfrowania wrażliwych danych, która może umożliwić atakującemu odnalezienie hasha hasła. Podatność ta występuje, gdy atakujący przechwyci ruch między oprogramowaniem EcoStruxure Machine - Basic a kontrolerem Modicon M221 i złamie klucze szyfrujące.