CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
TOZED ZLT M30s router up to version 1.47 has an information disclosure vulnerability in the web management interface, in file /reqproc/proc_post, via manipulation of the goformId argument. The attack can be performed remotely, and the exploit is public.
JD Cloud BE6500 router version 4.4.1.r4308 has a command injection vulnerability in function sub_4780 of file /jdcapi via the ddns_name argument. The attack can be performed remotely, and the exploit is public.
Insufficient access control in the RTMP implementation in Pexip Infinity through 38.1 allows an attacker to disconnect RTMP streams traversing a Proxy Node.
Pexip Infinity versions 32.0 through 37.1 before 37.2, in certain OTJ (One Touch Join) configurations for Teams SIP Guest Join, has Improper Input Validation in the OTJ service, allowing a remote attacker to trigger a software abort via a crafted calendar invite, leading to a denial of service.
A vulnerability in Fujitsu / Fsas Technologies ETERNUS SF ACM/SC/Express (DX / AF Management Software) before 16.8-16.9.1 PA 2025-12. When collected maintenance data is accessible by a principal/authority other than ETERNUS SF Admin, an attacker could potentially affect system confidentiality, integrity, and availability.
ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is related to DocumentServer.
XSS vulnerability in Riello UPS NetMan 208 before 1.12, present in cgi-bin/loginbanner_w.cgi via a crafted banner.
Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/login.cgi username SQL Injection. For example, an attacker can delete the LOGINFAILEDTABLE table.
IBM Concert 1.0.0 through 2.1.0 stores sensitive information in cleartext during recursive docker builds which could be obtained by a local user.
MyNET up to v26.08.316 contains an Unauthenticated SQL Injection vulnerability via the intmenu parameter. An attacker can exploit this flaw without logging into the system.
MyNET up to v26.08 contains a reflected cross-site scripting (XSS) vulnerability via the ficheiro parameter. An attacker can inject malicious JavaScript that is reflected in the server response and executed in the victim's browser.
An open redirect vulnerability in the login endpoint of Blitz Panel v1.17.0 allows attackers to redirect users to malicious domains via a crafted URL. This issue affects the next_url parameter in the login endpoint and could lead to phishing or token theft after successful authentication.
Podatność CVE-2025-2154 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w systemie Specto CM, co prowadzi do możliwości ataku typu Stored XSS. Problem ten dotyczy wersji przed 17032025.
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPXPO PostX ultimate-post allows Retrieve Embedded Sensitive Data. This issue affects PostX from n/a through <= 5.0.3.
The Post Grid and Gutenberg Blocks plugin up to version 2.3.23 contains a Stored Cross-site Scripting (XSS) vulnerability that allows an attacker to inject a persistent script into the website.
The Editorial Calendar plugin up to version 3.8.8 contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels.
The WordPress plugin 'Accept Donations with PayPal & Stripe' up to version 1.5.2 has an Open Redirect vulnerability that could be used for phishing.
A Cross-Site Request Forgery (CSRF) vulnerability in the Rustaurius Five Star Restaurant Reservations WordPress plugin (restaurant-reservations). This issue affects Five Star Restaurant Reservations versions from n/a through 2.7.8.
The Yannick Lefebvre WordPress Link Library plugin (link-library) contains a Server-Side Request Forgery (SSRF) vulnerability. This issue affects versions from n/a through 7.8.7. The vulnerability may allow an attacker to force the server to make requests to arbitrary resources.
The YouTube Embed plugin up to version 5.4 contains a Stored Cross-site Scripting (XSS) vulnerability that allows an attacker to inject a persistent script into the website.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS