CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
KodExplorer version 4.51 contains a Cross-Site Scripting (XSS) vulnerability in the Description box of the Light App creation feature. An attacker can exploit this vulnerability by injecting XSS syntax into the Description field.
Sourcecodester Online Pizza Ordering System v1.0 has a Cross-site scripting (XSS) vulnerability in '/admin/index.php?page=categories' Category item.
The Albert Peschar WebwinkelKeur plugin versions up to 3.24 contains a Cross-Site Request Forgery (CSRF) vulnerability. This may allow attackers to perform unauthorized actions on behalf of users.
The Hostel Management System v.2.1 has a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the add course section.
The WP Zone Potent Donations plugin for WooCommerce versions <= 1.1.9 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.
CVE-2023-35887 vulnerability in Apache MINA exposes sensitive information to unauthorized actors. Logged users on SFTP servers may discover 'exists/does not exist' information about items outside the rooted tree using parent navigation or symlinks.
CVE-2023-35699 concerns cleartext storage on disk in the SICK ICR890-4 device. This allows an unauthenticated attacker with local access to the device to disclose sensitive information by accessing the SD card.
The SICK ICR890-4 has an observable response discrepancy that could allow a remote attacker to identify valid usernames for the FTP server from the response given during a failed login attempt.
Improper restriction of excessive authentication attempts in the SICK ICR890-4 could allow a remote attacker to brute-force user credentials.
The SmartBPM.NET component has a path traversal vulnerability in its file download function. An unauthenticated remote attacker can exploit this vulnerability to access arbitrary system files.
In the GitHub repository nilsteampassnet/teampass prior to version 3.0.10, there is improper encoding or escaping of output.
The Online Examination System Project version 1.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacker can craft a malicious link that, when clicked by an admin user, will delete a user account from the database without the admin's consent.
Chamilo versions 1.11.x up to 1.11.20 allow users with admin privileges to insert XSS in the usergroups management section.
Chamilo versions 1.11.x up to 1.11.20 allow users with admin privileges to insert XSS in the skills wheel.
Chamilo versions 1.11.x up to 1.11.20 allow users with admin privileges to insert XSS in the session category management section.
Chamilo versions 1.11.x up to 1.11.20 allow users with admin privileges to insert XSS in the extra fields management section.
Chamilo versions 1.11.x up to 1.11.20 allow users with admin privileges to insert XSS in the careers and promotions management section.
Chamilo versions 1.11.x up to 1.11.20 allow users with admin privilege accounts to insert XSS in the course categories' definition.
Chamilo versions 1.11.x up to 1.11.20 allow users with admin privilege accounts to insert XSS in the languages management section.
Zoho ManageEngine ADAudit Plus before version 7100 allows XSS via the username field.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS