CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In Fortra GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0, encrypted values use a static IV, allowing admin users to brute-force decryption of data.
Reflected XSS vulnerability in Semantic MediaWiki. An attacker can send a malicious URL with the '/index.php/Speciaal:GefacetteerdZoeken' endpoint parameter, allowing JavaScript execution in the victim's browser. This can lead to theft of user data such as session cookies or actions performed on behalf of the user.
Incorrect boundary conditions and integer overflow exist in the Audio/Video: Playback component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 150 and Thunderbird 150.
An issue exists in the JavaScript Engine component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 150 and Thunderbird 150.
Vulnerability involving an invalid pointer in the Audio/Video: Playback component. It was fixed in Firefox 150 and Thunderbird 150.
Other issue in the Networking: DNS component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.
Incorrect boundary conditions exist in the WebRTC component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.
A security issue exists in the Storage: IndexedDB component of the Firefox browser and the Thunderbird mail client. The vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
Inna kwestia w komponencie bibliotek w NSS. Ta podatność została naprawiona w Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150 oraz Thunderbird 140.10.
Information disclosure vulnerability in the Form Autofill component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
Incorrect boundary conditions exist in the DOM: Device Interfaces component of Firefox and Thunderbird. The issue was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
A mitigation bypass vulnerability exists in the File Handling component. It was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
A spoofing issue exists in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
An invalid pointer vulnerability exists in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
A mitigation bypass vulnerability exists in the DOM: postMessage component. It was fixed in Firefox 150 and Thunderbird 150.
A Path Traversal vulnerability in the ssh_sftpd module of Erlang OTP ssh allows an authenticated SFTP user to modify file attributes outside the configured chroot directory.
Navigate Content Management System contains a reflected Cross-Site Scripting (XSS) vulnerability in the '/blog' endpoint because user input is not properly sanitized through query parameters. This results in unsafe HTML rendering and could allow a remote attacker to execute JavaScript in the victim's browser.
Honor E APP is affected by an information leak vulnerability. Successful exploitation may affect service confidentiality.
An improper encoding or escaping vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 allows an adjacent attacker on the WLAN to cause a denial-of-service (DoS) condition in the web management interface. The attack requires convincing an authenticated administrator to visit the “AP Select” page while a malformed SSID is present.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS