CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Sagemcom F@ST3686 device with firmware version 1.0 HUN 3.97.0 is vulnerable to Cross-Site Scripting (XSS) attacks. The vulnerability exists in several ASP scripts: RgDiagnostics.asp, RgDdns.asp, RgFirewallEL.asp, and RgVpnL2tpPptp.asp.
Rukovoditel Project Management app version 2.6 is affected by a Cross Site Scripting (XSS) vulnerability. An attacker can inject JavaScript code into the filename.
Cross-Site Scripting (XSS) vulnerability in Gazie 7.29 allows an attacker to inject JavaScript code via the 'user_name' parameter in admin_utente.php. The injected code is stored persistently by the application.
A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user.
Zidentyfikowano podatność w rodzinie CPU SIMATIC S7-300, S7-400, WinAC RTX (F) 2010 oraz SINUMERIK 840D sl. Protokół uwierzytelniania między klientem a PLC przez port 102/tcp (ISO-TSAP) niewystarczająco chroni przesyłane hasło.
A Cross-site scripting (XSS) vulnerability in 'user-profile.php' in SourceCodester Daily Tracker System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'fullname' parameter.
Specifically timed and handcrafted traffic can cause internal errors in a WLAN device, leading to improper layer 2 Wi-Fi encryption and potential information disclosure over the air for a discrete set of traffic. Affected Snapdragon processors include APQ8053, IPQ4019, IPQ8064, MSM8909W, MSM8996AU, QCA9531, QCN5502, QCS405, SDX20, SM6150, SM7150.
A vulnerability in directory permissions of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to perform a directory traversal attack on a limited set of restricted directories. The issue is due to a flaw in the logic governing directory permissions. Successful exploitation could allow overwriting files on the device.
GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.
Stored XSS vulnerability in Spiceworks version 7.5.00107 and earlier. An attacker can inject malicious JavaScript via the name field in the Custom Groups function, which is displayed without sanitization on the /inventory/groups/ page.
An XSS vulnerability in osTicket before version 1.14.3 allows an attacker to inject malicious script via a crafted filename uploaded to the _uploadInlineImage() function in include/ajax.draft.php.
An XSS vulnerability in osTicket before version 1.14.3 exists due to missing input validation in include/staff/banrule.inc.php, where the echo statement outputs $info['notes'] without sanitization. An attacker can inject malicious JavaScript code that executes in other users' browsers.
Występuje podatność na zdalne wykonanie kodu w bibliotece kodeków Microsoft Windows, związana z obsługą obiektów w pamięci. Atakujący, który skutecznie wykorzysta tę podatność, może wykonać dowolny kod, pod warunkiem, że program przetworzy specjalnie przygotowany plik graficzny.
An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access.
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.
A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the user downloading an unintended file. This vulnerability affects Firefox for iOS < 28.
A rogue webpage could override the injected WKUserScript used by the logins autofill, potentially leaking a password for the current domain. Affects Firefox for iOS < 28.
Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (Issue 2 of 2). This enables injection of malicious script into the user interface.
Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (issue 1 of 2). This enables injection of malicious script into the user interface.
In Apache ActiveMQ Artemis versions 2.5.0 to 2.13.0, there is an XSS vulnerability that can be exploited through a specially crafted MQTT packet containing an XSS payload in the client-id or topic name. The XSS payload is injected into the admin console's browser.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS