CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers, HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. An attacker can bypass sanitization to inject active HTML and JavaScript, e.g., via encoded javascript: URLs, backslash-based relative URLs, markup-breaking names, raw </textarea> reintroduction, or preserved <style>/<meta http-equiv=refresh>/<base href> tags.
justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings, run selector matching over very large untrusted documents, construct DOM trees from untrusted structure, or enable linkification over attacker-controlled text may consume disproportionate CPU or memory. These are availability-only concerns and do not allow script execution, data disclosure, or sanitizer bypass.
A privilege escalation vulnerability in the StackGres operator allows a low-privileged tenant who owns a database to gain administrator privileges.
A vulnerability in SourceCodester Class and Exam Timetabling System 1.0 in the file /admin/edit_user_account.php (User Account Update component) allows manipulation of the id/username argument, leading to improper authorization. The attack may be launched remotely.
A vulnerability in itsourcecode Hospital Management System Project in PHP 1.0 in the file /viewservicetype.php allows manipulation of the delid argument, causing SQL injection. The attack may be initiated remotely.
GitLab CE/EE versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 have a path traversal vulnerability in the package registry that under certain conditions could allow an authenticated user to achieve remote code execution.
The Brave Popup Builder plugin up to version 0.8.5 has a broken access control issue. Any logged-in user, even Subscriber or WooCommerce Customer, can read popup content they shouldn't have access to by passing a post ID in the URL.
The Brave Popup Builder plugin up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them, which can lead to Reflected XSS attacks.
The Content Mask WordPress plugin before version 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages without holding the publish capability.
The WooCommerce Bookings WordPress plugin before version 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products.
The RestrictMate WordPress plugin before version 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a new administrator account and gain a logged-in administrator session, leading to full site takeover.
A security flaw was discovered in Tenda CH22 1.0.0.1. The function formeditFileName in /goform/editFileName is vulnerable to command injection via the editNameMit argument. The attack can be launched remotely and the exploit has been released publicly.
A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The function envSchema.parse in lib/config.ts uses hard-coded credentials via the BETTER_AUTH_SECRET argument. The attack can be initiated remotely. The project was informed but has not responded.
A vulnerability was determined in vas3k TaxHacker up to 0.8.2. The function buildImapConfig in lib/email-sync/imap-client.ts is vulnerable to server-side request forgery via manipulation of host/port arguments. The attack can be launched remotely. A pull request to fix this issue awaits acceptance.
A vulnerability was found in SourceCodester Stock Management System 1.0. The file /php_action/getOrderReport.php is vulnerable to cross-site scripting via manipulation of clientName/clientContact arguments. The attack can be initiated remotely and the exploit has been made public.
A vulnerability has been found in SourceCodester Stock Management System 1.0. The file /php_action/printOrder.php is vulnerable to cross-site scripting via manipulation of clientName/clientContact arguments. The attack may be performed remotely and the exploit has been disclosed publicly.
A flaw has been found in sambitraj Student-Management-System up to commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The Management Mutation Handler is vulnerable to SQL injection via manipulation of roll_no/name/father_name/class/mobile/email/password/remark arguments. The attack can be carried out remotely. The exploit has been published and may be used. The project has not responded.
A vulnerability was detected in sambitraj Student-Management-System. Unknown functionality of the Dashboard component allows manipulation of roll_no/teacher_name arguments, leading to SQL injection. The attack can be executed remotely, and the exploit is now public.
A cross-site scripting vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0 in the file /BSIT2.php. Manipulation of the course argument leads to XSS. Remote exploitation is possible, and the exploit has been publicly disclosed.
chirpmyradio CHIRP before commit 39178db allows eval injection via crafted CSV data. This occurs in _clean_tmode in drivers/kenwood_itm.py.