CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
DedeCMS v5.7.111 was found to have a reflective cross-site scripting (XSS) vulnerability in the select_media_post_wangEditor.php component. An attacker can inject malicious JavaScript code into a request, which will be executed in the victim's browser.
A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information.
In CPython 3.12.0 in the subprocess module on POSIX platforms, when the extra_groups=[] parameter is used, the process does not call setgroups(0, NULL) before exec(), causing the new process to inherit the parent process's groups. This issue was fixed in CPython 3.12.1 and only affects processes run with root privileges.
A stored cross-site scripting (XSS) vulnerability was discovered in DaiCuo version 2.5.15 in the /admin.php file. Attackers can inject malicious JavaScript or HTML via crafted input.
In MISP before version 2.4.179, there is an XSS vulnerability in the event timeline widget located in app/Lib/Tools/EventTimelineTool.php.
The vulnerability in aiohttp allows an attacker to modify the HTTP request through improper validation, potentially leading to header injection or the creation of new requests if the attacker controls the HTTP method.
The Email Encoder plugin for WordPress by Jannis Thuemmig in version 2.1.8 and earlier contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.
In Symfony from versions 2.0.0, 5.0.0, and 6.0.0 up to 4.4.51, 5.4.31, and 6.3.8, some Twig filters in CodeExtension use `is_safe=html` but do not actually ensure their input is safe. As of versions 4.4.51, 5.4.31, and 6.3.8, Symfony escapes the output of the affected filters.
A Cross-Site Scripting vulnerability in Wonder CMS versions 3.2.0 through 3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component.
Vim has a use-after-free vulnerability in memory allocated in the `ga_grow_inner` function. This issue can occur when using the `:history` command, leading to an integer overflow and potential use-after-free.
A use-after-free flaw was found in the xorg-x11-server that may lead to an X server crash in a specific multi-screen configuration. The issue occurs when the pointer is warped from a window on one screen to the root window of another screen, followed by the destruction of the original window and then another window.
An out-of-bounds read flaw was found in the GRUB2 NTFS filesystem driver. A physically present attacker can present a specially crafted NTFS image to read arbitrary memory locations. A successful attack allows sensitive data cached in memory or EFI variable values to be leaked, posing a high confidentiality risk.
A vulnerability in the ArchiveBox web archiving system allows malicious JavaScript execution in the context of an admin session. The issue affects users who use the `wget` extractor and view archived pages. Malicious code can hijack admin privileges and perform arbitrary operations on the archive.
Multiple Stored Cross Site Scripting (XSS) vulnerabilities in Opart opartmultihtmlblock before version 2.0.12 and Opart multihtmlblock* version 1.0.0, allow remote authenticated users to inject arbitrary web script or HTML via the body_text or body_text_rude field in /sourcefiles/BlockhtmlClass.php and /sourcefiles/blockhtml.php.
A memory leak flaw was found in Libtiff's tiffcrop utility that occurs when processing a TIFF image file. An attacker can pass a crafted TIFF image file to the tiffcrop utility, causing this memory leak issue, resulting in application crashes and ultimately leading to denial of service.
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload in the subcmd parameter of the index.php component.
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary JavaScript code via a crafted title parameter in the index.php component.
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary JavaScript code via a crafted payload in the 'cmd' parameter of the index.php component.
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary JavaScript code via a crafted payload in the 'txt' parameter of the index.php component.
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary JavaScript code via a crafted payload to the ID parameter in the index.php component.