CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.11)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass configured file action policies if Intelligent Application Bypass (IAB) with a drop percentage threshold is also configured. The issue is due to incorrect counting of dropped traffic percentage. An attacker could send network traffic to the device, bypassing policies and allowing traffic that should be dropped.
A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a configured file action policy to drop the SMB protocol if a malware file is detected. The issue is due to how SMB handles a case where a large file transfer fails. An attacker could send a crafted SMB file transfer request through the device, allowing an SMB file containing malware to pass.
A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a configured file action policy intended to drop SMB2 and SMB3 protocols if malware is detected. The issue is due to incorrect detection of SMB2/SMB3 files based on total file length. An attacker could exploit this by sending a crafted SMB2 or SMB3 transfer request through the targeted device.
A cross-site scripting (XSS) vulnerability was found in osTicket before version 1.10.2 in the /scp/index.php script. An attacker can inject arbitrary JavaScript or HTML code via the "sort" parameter.
An integer format vulnerability in the ticket number generator in Enhancesoft osTicket before 1.10.2 allows remote attackers to cause a denial-of-service (preventing the creation of new tickets) via a large number of digits in the ticket number format setting.
Cross-site scripting (XSS) vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "order" parameter.
Cross-site scripting (XSS) vulnerability in /ajax.php/form/help-topic in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "message" parameter.
A cross-site scripting (XSS) vulnerability in ZmMailMsgView.getAttachmentLinkHtml in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7. Remote attackers can inject arbitrary web script or HTML via a Content-Location header in an email attachment.
A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass file policies configured to block files transmitted via the BitTorrent protocol. The issue is due to incorrect detection of BitTorrent handshake messages. An attacker could exploit this by sending a crafted BitTorrent connection request to an affected device.
Cisco Umbrella Virtual Appliance Version 2.0.3 and prior contained an undocumented encrypted remote support tunnel (SSH) that auto-initiated from the customer's appliance to Cisco's SSH Hubs. This tunnel allowed authorized personnel from the Cisco Umbrella team to access the appliance remotely without explicit customer approval.
The admin_edit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enable_password field, allowing admins to discover a hashed password by reading the audit log.
Zidentyfikowano podatność w kontrolerach automatyki Siemens APOGEE PXC i TALON TC BACnet we wszystkich wersjach poniżej V3.5. Podatność na przejście katalogu może umożliwić zdalnemu atakującemu z dostępem do sieci uzyskanie informacji o strukturze systemu plików urządzeń.
There is an illegal address access in the _nc_safe_strcat function in strings.c in ncurses 6.0 that will lead to a remote denial of service attack.
An illegal memory access was found in ncurses 6.0 in the fmt_entry function in progs/dump_entry.c, potentially leading to a remote denial of service attack.
An illegal memory access was found in ncurses 6.0 in the dump_uses() function in progs/dump_entry.c, potentially leading to a remote denial of service attack.
An illegal memory access was found in ncurses 6.0 in the postprocess_termcap() function in parse_entry.c, leading to a remote denial of service attack.
An illegal memory access was found in ncurses 6.0 in the _nc_read_entry_source() function in progs/tic.c, potentially leading to a remote denial of service attack.
An illegal memory access was found in ncurses 6.0 in the _nc_save_str function in alloc_entry.c, leading to a remote denial of service attack.
In MISP before version 2.4.79, there is a persistent XSS vulnerability via the comment field. It only affects users of the same instance because the comment field is not part of MISP synchronization.
W urządzeniach Schneider Electric Modicon PLCs Modicon M221, M241 i M251, w wersjach oprogramowania przed odpowiednio 1.5.0.0 oraz 4.0.5.11, odkryto problem z przewidywalnym zakresem wartości. Affected products generują niewystarczająco losowe numery początkowe sekwencji TCP, co może umożliwić atakującemu przewidywanie tych numerów na podstawie wcześniejszych wartości.