CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability was found in Kira-Pgr PromptShopMCP up to 5bc0cd17358e19a5415d11a531088170d7b81452. Affected is the function download_image of the file server.py of the component Image-Toolkit-MCP-Server. Performing a manipulation of the argument image_url results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Null pointer dereference vulnerability in the image codec module. Successful exploitation may affect availability.
Null pointer dereference vulnerability in the image codec module. Successful exploitation may affect availability.
Permission control vulnerability in the clipboard module. Successful exploitation may affect service confidentiality.
Permission control vulnerability in the multi-mode input module. Successful exploitation may affect service confidentiality.
Permission control vulnerability in the Wi-Fi enhancement module. Successful exploitation may affect availability.
Permission control vulnerability in the device key management module. Successful exploitation may affect availability.
Permission control vulnerability in the notification module. Successful exploitation may affect availability.
Permission control vulnerability in the notification service module. Successful exploitation may affect service confidentiality.
Permission control vulnerability in the Gallery module. Successful exploitation may affect service confidentiality.
SQL injection vulnerability in itsourcecode Hospital Management System 1.0, in file /viewprescriptionrecord.php via the delid argument. The attack can be launched remotely, and the exploit is now public.
A vulnerability has been detected in the Assimp library (Open Asset Import Library) version 17c12da. The issue affects the function Assimp::MDLImporter::ParseBoneTrafoKeys_3DGS_MDL7 in file code/AssetLib/MDL/MDLLoader.cpp, where manipulation of arguments transmatrix_count/pcBoneTransforms leads to buffer overflow. The attack can be initiated remotely, and the exploit is publicly available.
A cross-site scripting vulnerability has been detected in Online Shopping System 1.0 by code-projects in file offersmail.php. Manipulation of the email argument leads to XSS. The attack can be performed remotely, and the exploit is publicly available.
An authorization bypass vulnerability has been detected in Webkul Bagisto up to version 2.4.4 in file /admin/sales/rma/requests (Backend Sales RMA Endpoint). Manipulation allows remote authorization bypass. The exploit is publicly available. The vendor confirms that some issues have already been addressed, and the rest are planned for upcoming releases.
A vulnerability has been detected in Webkul Bagisto up to version 2.4.4 in file /admin/customers (Backend Customer Behavior Data Endpoint). Manipulation of the ID argument leads to improper privilege management. The attack can be executed remotely, and the exploit is publicly available. The vendor confirms that some issues have already been addressed, and the rest are planned for upcoming releases.
An authorization bypass vulnerability has been detected in Webkul Bagisto up to version 2.4.4 in file /admin/configuration/cache-management/execute (Configuration Management). Manipulation of the action argument leads to authorization bypass. The attack may be launched remotely, and the exploit is publicly available. The vendor confirms that some issues have already been addressed, and the rest are planned for upcoming releases.
A vulnerability has been detected in Webkul Bagisto up to version 2.4.4 in file /customer/account/rma/update-status (RMA State Validation). Manipulation leads to enforcement of behavioral workflow. The attack may be initiated remotely, and the exploit is publicly available. The vendor confirms that some issues have already been addressed, and the rest are planned for upcoming releases.
A cross-site scripting vulnerability has been detected in Alaev SEO Tools Extension up to version 1.0.10 for Chrome in the addDiv function of file src/popup.html (Popup UI component). Manipulation leads to basic XSS. The attack can be initiated remotely, and the exploit is publicly available. The vendor was contacted but did not respond.
A vulnerability has been detected in SourceCodester Best Employee Management System 1.0 in file /assets/uploadImage/Profile/, which allows information exposure through directory listing. The attack can be launched remotely.
The ShopSmart Loyalty for WooCommerce plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer's phone number to retrieve that customer's loyalty profile, including name, email, and account balance.