CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, affects the new hardware AmpereOne. Spectre-BHB uses shared branch history to influence mispredicted branches within the victim's hardware context.
An issue was discovered in the Linux kernel before version 6.3.3 related to an out-of-bounds read in the crc16 function in lib/crc16.c when called from fs/ext4/super.c. The problem arises from improper offset checking in the ext4_group_desc_csum function.
The New Policy form in the Microworld Technologies eScan management console has a Cross Site Scripting (XSS) vulnerability that allows a remote attacker to inject arbitrary code via the vulnerable parameters type, txtPolicyType, and Deletefileval.
A stored cross-site scripting (XSS) vulnerability in the Inline Table Editing application before 3.8.0 for Confluence allows attackers to store and execute arbitrary JavaScript via a crafted payload injected into the tables.
A vulnerability was found in gpt_academic version 3.37 and prior, allowing information disclosure through manipulation of the file argument in the Configuration File Handler component. This enables reading sensitive configuration files in some working directories.
Wtyczka Formcreator dla GLPI umożliwia tworzenie niestandardowych formularzy i zgłoszeń. Podatność na trwałe ataki XSS występuje w wersji 2.13.5 i wcześniejszych poprzez użycie znacznika `##FULLFORM##` do renderowania treści. Może to prowadzić do wykonania dowolnego kodu JavaScript w kontekście administratora lub technika.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository mkucej/i-librarian-free prior to version 5.10.4, allowing for the storage of malicious code.
A reflected Cross-site Scripting (XSS) vulnerability exists in the GitHub repository mkucej/i-librarian-free prior to version 5.10.4.
A critical vulnerability was found in the Lost and Found Information System version 1.0, affecting unknown code in the file /admin/?page=user/list. Manipulation of this code leads to improper access controls.
A critical vulnerability has been found in yiwent Vip Video Analysis 1.0, concerning an unknown functionality of the file data/title.php. Manipulation of the argument titurl leads to server-side request forgery.
In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability was present on the GitLab Connection page.
In JetBrains TeamCity versions before 2023.05, authentication checks were missing – 2FA was not checked for some sensitive account actions.
In JetBrains TeamCity before version 2023.05, a specific endpoint was vulnerable to brute force attacks.
In JetBrains TeamCity versions before 2023.05, a reflected XSS vulnerability was present on the Subscriptions page.
In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability was present in the NuGet feed page.
In JetBrains TeamCity versions before 2023.05, an open redirect vulnerability during oAuth configuration was present.
In JetBrains TeamCity before version 2023.05, 'password' type parameters from build dependencies could be logged in some cases.
In JetBrains TeamCity before version 2023.05, an XSS vulnerability was possible in the Plugin Vendor URL.
In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability existed on the 'Show Connection' page.
In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability was present in the Commit Status Publisher window.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS