CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.19)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A cross-site scripting (XSS) vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script in the victim's browser.
The Speed Optimizer plugin for WordPress up to version 7.8.0 is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access can inject arbitrary web scripts that execute when a user accesses an injected page. This is exploitable only when the Lazy Load Media option is enabled.
A vulnerability was found in xianrendzw EasyReport up to version 2.0.17.0522_Beta in the execSqlText/previewSqlText functions in DesignerController.java (SQL Preview Endpoint). Manipulation of the sqlText argument results in improper neutralization of special elements used in a template engine, potentially allowing remote attack. The exploit has been made public, and the project has not responded.
A vulnerability was found in xianrendzw EasyReport up to version 2.0.17.0522_Beta in the DataSourceController.add function in DataSourceController.java (QueryerFactory component). Manipulation of the queryerClass argument leads to permission issues, potentially allowing remote attack. The exploit has been publicly disclosed, and the project has not responded.
The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress up to version 1.9.15 is vulnerable to unauthorized data access due to improper capability check on the can_access function. Authenticated attackers with Contributor-level access can retrieve a master-password and access any password-protected content.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media Library Assistant allows Stored XSS. This issue affects Media Library Assistant from n/a through 3.39.
Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing from n/a through 5.2.30.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series from n/a through 2.17.0.
Vulnerability in linuxfabrik-lib and Linuxfabrik Monitoring Plugins allows reading files via a hidden --test argument that does not confine paths to the test directory. An attacker controlling the nagios or icinga account can disclose root-readable file contents, e.g., via the deb-updates plugin.
Vulnerability in Linuxfabrik Monitoring Plugins allows reading arbitrary files via the logfile plugin, which does not confine the path to /var/log. An attacker controlling the monitoring account can read files such as /etc/shadow.
Cross-site Scripting (XSS) vulnerability in the Draft List plugin (simple-draft-list) allows stored XSS. Versions up to 2.6.4 are affected.
Vulnerability in libheif (up to 1.23.0) allows application crash via a crafted HEIF sequence that does not register sequence tracks, leading to assertion or undefined behavior when calling heif_context_get_track.
Vulnerability in libheif (up to 1.23.0) allows heap corruption via a crafted image sequence with mismatched alpha plane dimensions, leading to out-of-bounds write during encoding.
Vulnerability in libheif (up to 1.23.0) allows crash or corrupt tiling results via a crafted HEIF/AVIF file with a clean aperture box that reduces dimensions to zero, causing underflow and assertion or incorrect results.
Vulnerability in 4gaBoards (before 3.3.9) allows any authenticated user to enumerate accounts and read data of all users via the /api/users API, without authorization.
Vulnerability in Streambert (from 2.5.0 to 2.6.0) allows script injection in the Wyzie key redemption window, which removes the CSP header and lacks window open restrictions, enabling malicious script execution in the application context.
Vulnerability in CefSharp (before 148.0.90) allows reading files outside the configured directory via FolderSchemeHandlerFactory, which uses an incorrect path prefix comparison, enabling access to files in similarly named directories.
Vulnerability in Confidential Containers Guest Components (from 0.16.0 to 0.20.0) allows creating a hardlink outside the destination directory via a crafted OCI image layer, potentially leading to writing data outside the pod VM.
Information leak in Skia in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
Incorrect reference resolution in Core in Google Chrome on Android prior to 151.0.7922.169 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)