CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in ics213.php. An authenticated attacker can inject arbitrary JavaScript via the frm_add_str POST parameter, which is directly placed into an HTML form hidden input value attribute.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in ics205a.php. An authenticated attacker can inject arbitrary JavaScript via the frm_add_str POST parameter, which is directly placed into an HTML form hidden input value attribute.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in ics205.php. An authenticated attacker can inject arbitrary JavaScript via the frm_add_str POST parameter, which is directly placed into an HTML form hidden input value attribute.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in ics202.php. An authenticated attacker can inject arbitrary JavaScript via the frm_add_str POST parameter, which is directly placed into an HTML form hidden input value attribute.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in icons/buttons/landb.php. An authenticated attacker can inject arbitrary JavaScript by passing unsanitized values in POST parameters frm_name and frm_id, which are directly rendered into HTML and inline JavaScript.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in delete_module.php. An authenticated attacker can inject arbitrary JavaScript via multiple POST parameters (module_choice, flag, confirmation) that are directly placed into rendered HTML content and form action attributes.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in db_loader.php. An authenticated attacker can inject arbitrary JavaScript by passing unsanitized values in POST parameters (ticketshost, ticketsdb, ticketsuser, ticketspassword, ticketsprefix, db_schema) directly into HTML form input value attributes.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in circle.php. An authenticated attacker can inject arbitrary JavaScript by passing an unsanitized value in the frm_id POST parameter directly into an HTML form input value attribute.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in add_nm.php. An authenticated attacker can inject arbitrary JavaScript by passing an unsanitized value in the ticket_id POST parameter directly into an HTML form input value attribute and an inline JavaScript string literal.
The HAPPY plugin from VillaTheme up to version 1.0.10 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Open ISES Tickets before 3.44.2 contains a reflected XSS vulnerability in add.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized ticket_id POST parameter that is directly placed into the value attribute of an HTML form input.
A buffer overflow vulnerability in Uncrustify (version v.Uncrustify_d-0.82.0-132-bcc41cbdc) exists in the check_template function, tokenize_cleanup function, and check_template.cpp file. A local attacker can cause a denial of service.
Improper restriction of excessive authentication attempts vulnerability in Turkiye Electricity Transmission Corporation (TEİAŞ) Mobile Application allows Brute Force. This issue affects Mobile Application: from 1.6.2 before 1.13.
Insufficient session expiration vulnerability in Turkiye Electricity Transmission Corporation (TEİAŞ) Mobile Application allows Session Hijacking. This issue affects Mobile Application: from 1.6.2 before 1.13.
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents. The attack requires access to the server and prior administrative credentials.
Request Tracker is vulnerable to reflected XSS via the "Page" parameter in GET requests. An attacker can craft a URL that executes arbitrary JavaScript in the victim's browser. Affects versions 5.0.4-5.0.9 and 6.0.0-6.0.2.
In the Linux kernel network subsystem, a vulnerability was found in the RED queuing discipline. When RED has children (e.g., qfq) and a parent (e.g., tbf) calls dequeue after peek, a null pointer dereference and kernel panic can occur. The fix replaces the direct dequeue call with qdisc_dequeue_peeked().
The affected product may expose credentials remotely between low privileged visualization users during concurrent login operations due to insufficient isolation of authentication data. The vulnerability affects only login operations within an active visualization session.
In cap_net service, omitting a key from a new limit treated it as 'allow any' instead of rejecting it, potentially allowing an application to extend network permissions.
In the FreeBSD kernel (fusefs), when handling extended attributes, the fusefs kernel module calls strlen() on a daemon-supplied buffer without verifying that the entire list is NUL-terminated. A malicious daemon can send a non-NUL-terminated list, causing an out-of-bounds read of one buffer and potential out-of-bounds write of a second buffer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS