CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Insufficient validation of untrusted input in the Dawn component in Google Chrome on macOS prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
Insufficient policy enforcement in the Network component in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the utility process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Google Chrome prior to version 149.0.7827.103 has an out-of-bounds read vulnerability in Skia, allowing a remote attacker who has compromised the renderer process to leak cross-origin data via a crafted HTML page. Severity: High.
In typo3/html-sanitizer before version 2.3.2, when ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags are not recognized by the sanitizer but accepted by browsers, allowing XSS bypass.
In D-Link DGS-1100-08PD version 1.00.006, the Web Interface component's /etc/boa.conf file has a least privilege violation.
A cross-site scripting vulnerability was found in the imvks786 student management system in the /add.php file. Manipulation of the name/address/fname arguments allows remote script injection. The exploit is publicly available.
The Req library (Elixir) versions 0.5.3 through 0.6.0 have a CRLF injection vulnerability. An attacker can manipulate multipart part metadata (e.g., filename) to inject headers and smuggle additional parts into the request sent to the downstream server.
phpMyFAQ prior to version 4.1.4 uses SHA-1 for hashing attachment passwords. SHA-1 is cryptographically broken and vulnerable to collision attacks since 2017.
A cross-site scripting vulnerability was found in SourceCodester Inventory System 1.0 in the header.php file. Manipulation of unknown functionality allows remote attack. The exploit is publicly available.
In Bolt CMS up to version 3.7.5, in the TextType.php file of the HTML Attribute Handler component, manipulation of the style argument leads to HTML injection. The attack is remote, exploit is public. The GitHub repository is archived and read-only, and the product is no longer supported.
An open redirect vulnerability was found in JeecgBoot up to version 3.9.2 in the Third-Party Login component. The attack requires social engineering and is difficult to exploit.
A stored XSS vulnerability was found in CodeAstro Human Resource Management System 1.0 in the Notice Board Management function. Manipulating the 'Notice Title' argument via POST with JavaScript code leads to script execution in the victim's browser.
Vulnerability in grepai up to 0.35.0. The PostgresStore.LookupByContentHash function in indexer/chunker.go (Postgres Embedding Cache component) uses a weak hash for the content_hash argument. Attack requires local access and high complexity. Exploit is publicly available.
A flaw in kokke tiny-regex-c up to commit f2632c6d9ed25272987471cdb8b70395c2460bdb. The matchstar function in re.c (Pattern Handler component) causes inefficient regular expression complexity. The attack requires local access. The exploit has been published.
Vulnerability in SourceCodester Hospitals Patient Records Management System 1.0. The file /admin/?page=room_types is vulnerable to XSS via manipulation of the room argument. The attack can be performed remotely.
A business logic error was discovered in songquanpeng one-api up to version 0.6.11-preview.7 in the Redeem function of model/redemption.go. The attack is remote but requires high complexity and is difficult to exploit.
An information disclosure vulnerability was found in JeecgBoot up to version 3.9.2 in the queryPageList function of SysUserController.java. Manipulating the 'salt' argument allows remote unauthorized data access.
A vulnerability in SecureAge CatchPulse up to version 10.9.3. An unknown function in the saappctl.sys library (IOCTL Handler component) leads to information disclosure. Requires local access. The exploit has been publicly disclosed.
A vulnerability in FluentCMS 0.0.5 in an unknown function of file /admin/blocks in the Blocks Plugin component leads to cross-site scripting (XSS). The attack can be initiated remotely. The exploit has been made public.
Vulnerability in the WPvivid Backup & Migration WordPress plugin (up to version 0.9.128) allows an authenticated attacker with Administrator-level access to delete arbitrary directories on the server via the delete_cancel_staging_site() function due to insufficient path validation.