CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
A vulnerability in seakee CPA-Manager-Plus up to 1.11.10 affects the CPAResource function in the file apps/manager-server/internal/http/controller/proxy/handler.go of the HTTP Handler component. The manipulation leads to improper authorization. The attack can be initiated remotely.
A vulnerability in itsourcecode Sales and Inventory System 1.0 affects an unknown part of the file /pages/us_edit.php. Manipulation of the argument ID leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
A vulnerability in ningzichun Student Management System (up to a specific commit) affects the session_start function in login.php. The manipulation results in session fixation. The attack can be launched remotely, and the exploit is public. The product does not use versioning, so affected and unaffected release details are unavailable.
A cross-site scripting (XSS) vulnerability in Skype for Business allows an unauthorized attacker to perform spoofing over a network.
An out-of-bounds read vulnerability in Skype for Business allows an authorized attacker to deny service over a network.
A vulnerability in Skype for Business that generates error messages containing sensitive information allows an unauthorized attacker to disclose information over a network.
A null pointer dereference vulnerability in Skype for Business allows an authorized attacker to deny service over a network.
A cross-site scripting (XSS) vulnerability in Skype for Business allows an unauthorized attacker to perform spoofing over a network.
In parsePartHeaders of multiple files, there is a possible persistent denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
In convertCleanApertureToRect of HeifCleanAperture.cpp, there is a possible temporary denial of service due to an integer overflow. This can be exploited remotely without additional privileges or user interaction.
In the initForUserNoTracing function in VoiceInteractionManagerService.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service without additional execution privileges. User interaction is not needed for exploitation.
In btm_sec_encrypt_change of btm_sec.cc, there is a possible downgrade attack due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
In add of WifiNetworkSuggestionsManager.java, there is a possible persistent DOS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
In parseInterventionFromXml of GameManagerService.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service without additional execution privileges. User interaction is not needed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS