CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker version 1.0.5 allows a remote attacker to execute arbitrary JavaScript code via a crafted payload in the index.php component.
A stored cross-site scripting (XSS) vulnerability was found in DedeBIZ v6.2.11 in the Website column management function. Attackers can inject malicious JavaScript or HTML into the title parameter, leading to script execution in the victim's browser.
A flaw was found in Red Hat's AMQ-Streams, which affects the OKHttp component. The issue involves information disclosure via an exception triggered by a header containing an illegal value.
A cross-site scripting (XSS) vulnerability in Froala Editor v4.1.1 allows remote attackers to execute arbitrary code via the 'Insert link' parameter in the 'Insert Image' component.
A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary JavaScript or HTML via the alt-text field. This affects all pages containing the navbar including the login page, enabling the attacker to steal plaintext credentials.
A SQL injection vulnerability in Nagios XI versions 5.11.0 through 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in a POST request to /nagiosxi/admin/banner_message-ajaxhelper.php.
A Cross-Site Scripting (XSS) vulnerability was found in Jodit Editor version 4.0.0-beta.86. The flaw allows a remote attacker to inject malicious JavaScript code through the rich text editor component.
An information leak in Coffee-jumbo v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
An information leak in youmart-tokunaga v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
An information leak vulnerability in TonTon-Tei_waiting Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
An information leak vulnerability in THE_B_members card version 13.6.1 allows attackers to obtain the channel access token and send crafted messages.
An information leak in YKC Tokushima_awayokocho Line v13.6.1 allows attackers to obtain the channel access token. With this token, they can send crafted messages.
An information leak vulnerability in Cheese Cafe Line v13.6.1 allows attackers to obtain the channel access token. This token can be used to send crafted messages.
An information leak in Camp Style Project Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
A use-after-free flaw has been found in glibc's getaddrinfo function. In an extremely rare scenario where an NSS module implements only specific hooks and the query meets certain conditions, an application crash may occur.
A reflected cross-site scripting (XSS) vulnerability exists in the File Manager function of Webmin v2.100. It allows attackers to execute malicious scripts by injecting a crafted payload into the 'Find in Results' file.
Webmin version 2.100 contains a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious HTML or JavaScript code via the cloned module name parameter.
A stored XSS vulnerability was found in Webmin v2.100 in the Usermin Configuration function. Attackers can inject malicious JavaScript or HTML into the Custom field, leading to script execution in the victim's browser.
In Webmin 2.100, a Cross-Site Scripting (XSS) vulnerability was found in the File Manager functionality. An attacker can inject malicious code that executes in the victim's browser during file search or replace operations.
A reflected cross-site scripting (XSS) vulnerability exists in the File Manager function of Webmin v2.100. It allows attackers to execute malicious scripts by injecting a crafted payload into the 'Replace in Results' file.