CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions.
Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions.
Unauthenticated CSRF vulnerability in Hash Form versions up to 1.4.0. An attacker can exploit this to perform unauthorized actions in the context of a logged-in administrator.
Unauthenticated CSRF vulnerability in Fluent Support Pro versions up to 2.3.1. An attacker can exploit this to perform unauthorized actions in the context of a logged-in user.
IDOR vulnerability in Fluent Boards Pro versions up to 2.0.11, affecting subscriber role users. Allows access to unauthorized objects.
SSRF vulnerability in FluentCRM Pro versions up to 3.1.12, affecting subscriber role users. Allows sending requests from the server to internal resources.
Broken Access Control vulnerability in Fluent Support Pro versions up to 2.3.1, affecting subscriber role users. Allows unauthorized access to functions or data.
SQL injection vulnerability in FluentCRM Pro versions up to 3.1.12. An attacker can exploit it to manipulate database queries.
SSRF vulnerability in Shared Files versions up to 1.7.69, affecting contributor role users. Allows sending requests from the server to internal resources.
Unauthenticated Broken Access Control vulnerability in Booking and Rental Manager versions up to 2.7.5. Allows unauthorized access to functions or data without authentication.
SQL injection vulnerability in Online Clinic Management System 1.0, in success/login.php, in the Admin Login component. Manipulation of the Username argument leads to SQL injection. Remote exploitation is possible.
Firmware in KAON PG5298A and PG5298B routers allows an unauthenticated user to query a specific endpoint and acquire sensitive information such as the admin portal password. Fixed in firmware versions 3.0.82 (PG5298A) and 4.0.82 (PG5298B).
Unauthenticated Local File Inclusion in Verdure Core versions up to 1.2. Allows reading sensitive files from the server.
Unauthenticated Local File Inclusion in Måne versions up to 1.7. Allows reading sensitive files from the server.
Unauthenticated PHP Object Injection in FreightCo versions up to 1.1.15. An attacker can send crafted data to execute arbitrary code.
Unauthenticated Privilege Escalation in Jawn versions up to 1.4.2. An attacker can gain elevated privileges without authentication.
Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons versions up to 2.9.9. Allows injecting malicious script into the page.
Unauthenticated Cross Site Scripting (XSS) in Urna versions up to 2.6.2. Allows injecting malicious script into the page.
Unauthenticated Cross Site Scripting (XSS) in WPComplete versions up to 2.9.5.6. Allows injecting malicious script into the page.
Unauthenticated Local File Inclusion in WP Cafe Pro versions before 3.0.15. An attacker can read arbitrary files from the server.