CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly. Although no sensitive information (e.g., credentials, PII) was discovered, exposing API documentation to unauthenticated users can increase the overall attack surface.
HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken code directly into production environments.
A flaw was found in JSS (Java Security Services). The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without TRUSTED_CA flags to be accepted as trust anchors for TLS connections. In non-default configurations where certificate revocation checking is disabled, this could allow a man-in-the-middle attacker to forge certificates accepted by PKI client connections.
Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions.
Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions.
Unauthenticated CSRF vulnerability in Hash Form versions up to 1.4.0. An attacker can exploit this to perform unauthorized actions in the context of a logged-in administrator.
Unauthenticated CSRF vulnerability in Fluent Support Pro versions up to 2.3.1. An attacker can exploit this to perform unauthorized actions in the context of a logged-in user.
IDOR vulnerability in Fluent Boards Pro versions up to 2.0.11, affecting subscriber role users. Allows access to unauthorized objects.
SSRF vulnerability in FluentCRM Pro versions up to 3.1.12, affecting subscriber role users. Allows sending requests from the server to internal resources.
Broken Access Control vulnerability in Fluent Support Pro versions up to 2.3.1, affecting subscriber role users. Allows unauthorized access to functions or data.
SQL injection vulnerability in FluentCRM Pro versions up to 3.1.12. An attacker can exploit it to manipulate database queries.
SSRF vulnerability in Shared Files versions up to 1.7.69, affecting contributor role users. Allows sending requests from the server to internal resources.
Unauthenticated Broken Access Control vulnerability in Booking and Rental Manager versions up to 2.7.5. Allows unauthorized access to functions or data without authentication.
SQL injection vulnerability in Online Clinic Management System 1.0, in success/login.php, in the Admin Login component. Manipulation of the Username argument leads to SQL injection. Remote exploitation is possible.
Firmware in KAON PG5298A and PG5298B routers allows an unauthenticated user to query a specific endpoint and acquire sensitive information such as the admin portal password. Fixed in firmware versions 3.0.82 (PG5298A) and 4.0.82 (PG5298B).
Unauthenticated Local File Inclusion in Verdure Core versions up to 1.2. Allows reading sensitive files from the server.
Unauthenticated Local File Inclusion in Måne versions up to 1.7. Allows reading sensitive files from the server.
Unauthenticated PHP Object Injection in FreightCo versions up to 1.1.15. An attacker can send crafted data to execute arbitrary code.
Unauthenticated Privilege Escalation in Jawn versions up to 1.4.2. An attacker can gain elevated privileges without authentication.
Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons versions up to 2.9.9. Allows injecting malicious script into the page.