CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A Cross Site Scripting vulnerability was found in Chamilo LMS version 1.11.18. It allows a local authenticated attacker to execute arbitrary code via the homepage function.
A Cross-Site Scripting (XSS) vulnerability was found in Chamilo LMS version 1.11.18. A local attacker can exploit the course category parameters to execute arbitrary JavaScript code in the victim's browser.
A Cross Site Scripting (XSS) vulnerability was found in Chamilo LMS version 1.11.18. It allows a local attacker to execute arbitrary code via the resource sequencing parameters.
A Cross-Site Scripting vulnerability was found in Chamilo LMS version 1.11.18. A local attacker can use the skype and linedin_url parameters to execute arbitrary JavaScript code in the victim's browser.
A Cross-Site Scripting (XSS) vulnerability was found in Chamilo LMS version 1.11.18. A local attacker can execute arbitrary JavaScript code via the skills wheel parameter.
A Cross-Site Scripting vulnerability was found in Chamilo LMS version 1.11.18. A local attacker can execute arbitrary JavaScript code via the forum title parameter.
A Cross-Site Scripting (XSS) vulnerability was found in Chamilo LMS version 1.11.18 in the system announcements parameter. It allows a local attacker to execute arbitrary JavaScript code in the victim's browser.
A buffer overflow vulnerability was found in Libtiff version 4.0.7. A local attacker can exploit the tiffcp function in tiffcp.c to cause a denial of service (DoS).
In SIMATIC Cloud Connect 7 CC712 (versions >= V2.0 < V2.1) and CC716 (versions >= V2.0 < V2.1), the export endpoint discloses some undocumented files. This could allow an unauthenticated remote attacker to gain access to additional information resources.
The export endpoint in SIMATIC Cloud Connect 7 is accessible via REST API without authentication. This could allow an unauthenticated remote attacker to download files available via the endpoint.
SIMATIC Cloud Connect 7 devices (CC712 and CC716) in versions prior to V2.1 are vulnerable to a denial of service when parsing a random non-JSON MQTT payload. An attacker able to manipulate communication between the MQTT broker and the device can cause a denial of service.
A vulnerability in SIMATIC Cloud Connect 7 CC712 (versions >= V2.0 < V2.1) and CC716 (versions >= V2.0 < V2.1) involves a path traversal flaw in the upload feature of the web-based management. An authenticated privileged remote attacker could overwrite or download any file the Linux user 'ccuser' has write or read-only access to, respectively.
SAP CRM (WebClient UI) versions S4FND 102-107 and WEBCUIF 700-801 does not sufficiently encode user-controlled inputs, resulting in a stored Cross-Site Scripting (XSS) vulnerability. An attacker could store a malicious URL and lure the victim to click, causing script execution in the victim's session.
SAP BusinessObjects Business Intelligence Platform versions 420 and 430 do not sufficiently validate input, allowing an unauthenticated attacker to redirect users to an untrusted site via a malicious link. Successful exploitation can let an attacker view or modify information, causing a limited impact on confidentiality and integrity.
Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR.
The Category Specific RSS feed Subscription plugin for WordPress by Tips and Tricks HQ, Ruhul Amin, versions up to and including 2.1, contains a Cross-Site Request Forgery (CSRF) vulnerability. Lack of proper protections may allow an attacker to force a logged-in administrator to perform unintended actions.
Inappropriate implementation in PictureInPicture in Google Chrome prior to 113.0.5672.63 allowed a remote attacker who had compromised the renderer process to obfuscate the security UI via a crafted HTML page. Chromium rates the severity as Low.
Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to obfuscate main origin data via a crafted HTML page. Chromium rates the severity as Medium.
Use of out-of-range pointer offset in GitHub repository vim/vim prior to 9.0.1499.
A reflected Cross Site Scripting (XSS) vulnerability was found in Intermesh BV Group-Office version 6.6.145. Attackers can exploit the GO_LANGUAGE cookie to escalate privileges and obtain sensitive information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS