CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated privilege escalation vulnerability in TrueBooker versions up to and including 1.2.6. An attacker without logging in can elevate privileges, e.g., to administrator level.
SQL Injection vulnerability in NGG Smart Image Search plugin versions prior to 4.0.0. An unauthenticated attacker can inject SQL queries, potentially leading to unauthorized database access.
Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11.1.2 versions.
SQL Injection vulnerability in Maps Marker Pro plugin versions up to and including 4.32. An unauthenticated attacker can inject SQL queries, potentially leading to unauthorized database access.
Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3.9 versions.
Critical vulnerability (CVSS 9.8) in Joomla extension Balbooa Forms versions prior to 2.4.3.2. Allows an unauthenticated attacker to inject and execute arbitrary PHP code on the server via a URL parameter in a shortcode, when the form has a custom PHP handler configured.
Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it from the form's configured product prices. Neither endpoint enforces authentication or CSRF checks. An unauthenticated attacker can purchase any priced item for an arbitrary amount (e.g., $0.01), and can additionally forge line items, quantities, and shipping.
SQL injection vulnerability in Community by PeepSo plugin versions up to 9.0.5.2. An attacker with subscriber role can exploit this flaw to manipulate database queries.
Unauthenticated remote code execution (RCE) vulnerability in JetEngine plugin versions up to and including 3.8.14. An attacker can execute arbitrary code on the server without logging in.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Newsletter plugin versions up to 9.3.3. An attacker can inject malicious script without authentication.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Contest Gallery plugin versions up to 30.0.5. An attacker can inject malicious script without authentication.
SQL injection vulnerability in YITH WooCommerce Membership Premium plugin versions up to 2.33.0. An attacker with subscriber role can exploit this flaw to manipulate database queries.
Vulnerability in NetScaler ADC and NetScaler Gateway products. Affects ADC versions from 14.1 through 73.32 and from 13.1 through 63.21; Gateway versions from 14.1 through 73.32 and from 13.1 through 63.21.
Vulnerability in NetScaler ADC and NetScaler Gateway. Affects ADC versions from 14.1 through 73.32 and from 13.1 through 63.21; Gateway from 14.1 through 73.32 and from 13.1 through 63.21.
CSS injection vulnerability in M-Files Web before 26.8.16330.2. An authenticated vault administrator can inject arbitrary CSS, affecting the web UI shown to other vault users.
HTML injection vulnerability in M-Files Web before 26.8.16330.2. An authenticated attacker can affect web UI contents displayed to other users.
In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault.
In mod_cluster's AdvertiseListenerImpl, a single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without "Date:", "Digest:", and "Sequence:" headers triggers a NullPointerException in verifyDigest() that is not caught. This causes the advertise listener thread to terminate permanently, and the failure is silent (isListening() continues to return true) until the node is restarted.
AIL Framework contains a server-side request forgery (SSRF) vulnerability in its crawler submission functionality. A low-privileged authenticated user can submit an arbitrary URL for crawling without adequate validation of the destination host. The crawler can be instructed to make requests to internal addresses, including loopback, private networks, and cloud metadata services.
An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field.