CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.20)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Cross Site Scripting (XSS) vulnerability in GeoDirectory versions up to 2.8.172. The attack requires contributor-level privileges.
Broken Access Control vulnerability in Appointment Hour Booking versions up to 1.5.91. The attack does not require authentication.
Broken Access Control vulnerability in MultiVendorX versions up to 5.0.14. The attack does not require authentication.
Cross Site Scripting (XSS) vulnerability in WP Tab Widget versions up to 1.2.11. The attack requires contributor-level privileges.
Cross Site Scripting (XSS) vulnerability in the Table of Contents Block in versions up to 1.5.0. A user with Contributor role can inject malicious script.
Cross Site Scripting (XSS) vulnerability in Typing Effect in versions up to 1.3.7. A user with Contributor role can inject malicious script.
Cross Site Scripting (XSS) vulnerability in Wufoo Shortcode in versions up to 1.55. A user with Contributor role can inject malicious script.
Cross Site Scripting (XSS) vulnerability in Video Conferencing with Zoom in versions up to 4.6.8. A user with Contributor role can inject malicious script.
Cross Site Scripting (XSS) vulnerability in Login With Ajax in versions up to 4.5.1. A user with Contributor role can inject malicious script.
Cross Site Scripting (XSS) vulnerability in WPZOOM Forms – Contact Form Plugin for Gutenberg in versions up to 2.0.4. A user with Contributor role can inject malicious script.
Cross Site Scripting (XSS) vulnerability in Frontend Admin by DynamiApps in versions up to 3.29.10. A user with Contributor role can inject malicious script.
Cross Site Scripting (XSS) vulnerability in Featured Video Plus in versions up to 2.3.3. A user with Contributor role can inject malicious script.
Cross Site Scripting (XSS) vulnerability in Wise Chat in versions up to 3.4. A user with Contributor role can inject malicious script.
Insecure Direct Object References (IDOR) vulnerability in Modal Survey in versions up to 2.0.2.2.3. A user with Subscriber role can access unauthorized resources.
In yawkat LZ4 Java before version 1.11.1, JNI-backed XXHash functions fail to validate the byte array and off/len arguments, allowing null arrays or oversized ranges to reach native code. This can cause reads outside the Java array and fatal JVM termination. Fixed in version 1.11.1.
In goshs, a SimpleHTTPServer written in Go, before version 2.1.0, ShareHandler reads the share token's DownloadLimit under RLock, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same snapshot and pass the check, exceeding the intended cap. Version 2.1.0 patches the issue.
The [Aotuman] Grab WeChat Articles plugin version 2.0.1 and earlier contains a Server Side Request Forgery (SSRF) vulnerability in the subscriber. This allows an attacker to send requests from the server to internal resources.
The 'stringprep' module did not process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This causes mismatches when processing domain names using IDNA 2003 (the 'idna' codec) and the in_table_b2() function of the 'stringprep' module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.
Race condition vulnerability in the JavaScript Engine component. Fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.