CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through 19.6.0, an incoming Setup message to addons/ooh323c/src/ooq931.c with a malformed Calling or Called Party IE can cause a crash.
The Clerk WordPress plugin before version 4.0.0 is affected by time-based attacks in the validation function for all API requests. The issue arises from the use of comparison operators to verify API keys against those stored in the site options.
Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /calendar/viewcalendar.php. This flaw allows an attacker to inject arbitrary web scripts or HTML via the Subject field.
A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /forums/editforum.php. It allows an attacker to inject arbitrary web scripts or HTML via the Name field.
A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /general/search.php?searchtype=simple. Attackers can inject arbitrary web scripts or HTML via a crafted payload in the Search field.
A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /meetings/listmeetings.php. Attackers can inject arbitrary web scripts or HTML via the Name field, leading to script execution in the victim's browser.
A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /clients/listclients.php. Attackers can inject arbitrary JavaScript or HTML into the Name field, leading to script execution in the victim's browser.
A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /projects/listprojects.php. Attackers can inject arbitrary web scripts or HTML via the Name field, leading to script execution in the victim's browser.
A cross-site scripting (XSS) vulnerability was discovered in the Chat function of webtareas 2.4p5. This flaw allows attackers to inject arbitrary web scripts or HTML via the Messages field.
A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the /contacts/listcontacts.php component. Attackers can inject arbitrary web scripts or HTML via the Last Name field when adding a contact.
A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /linkedcontent/listfiles.php. Attackers can inject arbitrary web scripts or HTML into the Name field after clicking 'Add'.
Rukovoditel v3.2.1 was found to have a stored cross-site scripting (XSS) vulnerability in the application configuration module. An attacker can inject malicious JavaScript or HTML into the Copyright Text field, which executes upon saving.
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.php?module=entities/forms&entities_id=24. Attackers can inject malicious JavaScript or HTML into the Name field, leading to arbitrary script execution in victims' browsers.
Rukovoditel v3.2.1 was found to have a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. Attackers can inject malicious JavaScript or HTML into the Name field, leading to script execution in other users' browsers.
Rukovoditel v3.2.1 contains a stored XSS vulnerability in the Add New Field function. Attackers can inject malicious JavaScript or HTML into the Short Name field, leading to script execution in other users' browsers.
Rukovoditel v3.2.1 was found to have a stored cross-site scripting (XSS) vulnerability in the Entities Group feature. Attackers can inject malicious JavaScript or HTML into the Name field, leading to script execution in other users' browsers.
Rukovoditel v3.2.1 contains a stored cross-site scripting (XSS) vulnerability in the Highlight Row feature. An attacker can inject malicious JavaScript or HTML into the Note field, leading to script execution in the victim's browser.
Rukovoditel v3.2.1 was found to have a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module=help_pages/pages&entities_id=24. Attackers can inject arbitrary JavaScript or HTML into the Title field, which will be executed in other users' browsers.
Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the heading_field_id parameter. An attacker can exploit this flaw to execute unauthorized database queries.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS