CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.11)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to access hidden commands. This is due to undocumented configuration commands. Successful exploitation could allow configuration changes to sections that should not be exposed to CLI access.
A vulnerability in the Snort detection engine of multiple Cisco products could allow an unauthenticated, remote attacker to bypass a configured File Policy for HTTP. The issue is due to incorrect detection of modified HTTP packets used in chunked responses. An attacker could send crafted HTTP packets through an affected device, potentially bypassing the policy and delivering a malicious payload.
In various locations in SystemUI, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure of contact data with User execution privileges needed.
The Verint Workforce Optimization suite version 15.1 (15.1.0.37634) has an unauthenticated information disclosure vulnerability via API. An attacker without valid credentials can access sensitive data.
The Sagemcom F@ST3686 device with firmware version 1.0 HUN 3.97.0 is vulnerable to Cross-Site Scripting (XSS) attacks. The vulnerability exists in several ASP scripts: RgDiagnostics.asp, RgDdns.asp, RgFirewallEL.asp, and RgVpnL2tpPptp.asp.
Rukovoditel Project Management app version 2.6 is affected by a Cross Site Scripting (XSS) vulnerability. An attacker can inject JavaScript code into the filename.
Cross-Site Scripting (XSS) vulnerability in Gazie 7.29 allows an attacker to inject JavaScript code via the 'user_name' parameter in admin_utente.php. The injected code is stored persistently by the application.
Zidentyfikowano podatność w rodzinie CPU SIMATIC S7-300, S7-400, WinAC RTX (F) 2010 oraz SINUMERIK 840D sl. Protokół uwierzytelniania między klientem a PLC przez port 102/tcp (ISO-TSAP) niewystarczająco chroni przesyłane hasło.
A Cross-site scripting (XSS) vulnerability in 'user-profile.php' in SourceCodester Daily Tracker System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'fullname' parameter.
Stored XSS vulnerability in Spiceworks version 7.5.00107 and earlier. An attacker can inject malicious JavaScript via the name field in the Custom Groups function, which is displayed without sanitization on the /inventory/groups/ page.
An XSS vulnerability in osTicket before version 1.14.3 allows an attacker to inject malicious script via a crafted filename uploaded to the _uploadInlineImage() function in include/ajax.draft.php.
An XSS vulnerability in osTicket before version 1.14.3 exists due to missing input validation in include/staff/banrule.inc.php, where the echo statement outputs $info['notes'] without sanitization. An attacker can inject malicious JavaScript code that executes in other users' browsers.
Występuje podatność na zdalne wykonanie kodu w bibliotece kodeków Microsoft Windows, związana z obsługą obiektów w pamięci. Atakujący, który skutecznie wykorzysta tę podatność, może wykonać dowolny kod, pod warunkiem, że program przetworzy specjalnie przygotowany plik graficzny.
In Apache ActiveMQ Artemis versions 2.5.0 to 2.13.0, there is an XSS vulnerability that can be exploited through a specially crafted MQTT packet containing an XSS payload in the client-id or topic name. The XSS payload is injected into the admin console's browser.
An issue was discovered in MISP version 2.4.128, where app/Controller/EventsController.php lacks an event ACL check before allowing a user to send an event contact form.
A flaw was found in ActiveMQ Artemis from versions 2.7.0 to 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file (etc/artemis-users.properties) when executing the `resetUsers` operation. A local attacker can use this flaw to read the contents of the Artemis shadow file.
In MISP versions before 2.4.126, there is an XSS vulnerability in the resolved attributes view in app/View/Events/resolved_attributes.ctp.
A vulnerability in the Snort detection engine of multiple Cisco products could allow an unauthenticated, remote attacker to bypass configured file policies. The issue is due to errors in how Snort handles specific HTTP responses. An attacker could send crafted HTTP packets through an affected system, potentially bypassing policies and delivering a malicious payload.
A vulnerability in the Image Signature Verification feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker with administrator-level credentials to install a malicious software patch. This is due to improper verification of digital signatures for patch images. An attacker could exploit this by crafting an unsigned patch to bypass signature checks, potentially booting a malicious patch image.
A vulnerability in the TLS 1.3 policy with URL category functionality for Cisco FTD Software could allow an unauthenticated, remote attacker to bypass a configured TLS 1.3 policy to block traffic for a specific URL. The issue is due to a logic error with Snort handling of the connection with the TLS 1.3 policy and URL category configuration. An attacker could exploit this by sending crafted TLS 1.3 connections, bypassing the policy and accessing URLs that would normally be dropped.