CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
GPAC v2.3-DEV-rev449-g5948e4f70-master was found to contain a heap-use-after-free vulnerability in the gf_bs_align function at bitstream.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by supplying a crafted file.
Cross Site Scripting vulnerability in Spipu HTML2PDF before v.5.2.8 allows a remote attacker to execute arbitrary code via a crafted script to the forms.php.
A stored cross-site scripting (XSS) vulnerability in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Add New parameter under the New Buy section.
There is a Cross Site Scripting (XSS) vulnerability in the 'theme' parameter of preview.php in PHPJabbers Callback Widget v1.0.
There is a Cross Site Scripting (XSS) vulnerability in the message parameter of index.php in PHPJabbers Ticket Support Script v3.2.
There is a Cross Site Scripting (XSS) vulnerability in the 'action' parameter of index.php in PHPJabbers Make an Offer Widget v1.0.
PHPJabbers Fundraising Script v1.0 is vulnerable to Cross Site Scripting (XSS) via the 'action' parameter of index.php.
There is a Cross Site Scripting (XSS) vulnerability in the 'action' parameter of index.php in PHPJabbers Yacht Listing Script v1.0.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository omeka/omeka-s prior to version 4.0.4, allowing for the storage of malicious code.
Improper authorization of an index containing sensitive information exists in the GitHub repository omeka/omeka-s prior to version 4.0.4.
A critical vulnerability has been found in Bettershop LaikeTui, allowing unrestricted file uploads through manipulation of functionality in the file index.php?module=api&action=user&m=upload. The attack can be launched remotely.
A critical vulnerability was found in SourceCodester Inventory Management System version 1.0. Manipulation of the argument columns[0][data] in the staff_data.php file leads to SQL injection, which can be executed remotely.
A critical vulnerability has been found in SourceCodester Inventory Management System version 1.0. Manipulation of the 'customer' argument in the file app/ajax/search_purchase_paymen_report.php leads to SQL injection.
IBM Storage Copy Data Management versions 2.2.0.0 through 2.2.19.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
A critical vulnerability was found in the Online Graduate Tracer System 1.0, affecting the mysqli_query function in the sexit.php file. Manipulation of the id argument leads to SQL injection, which can be launched remotely.
A critical vulnerability has been found in SPA-Cart eCommerce CMS version 1.9.0.3, affecting an unknown part of the file /search in the GET Parameter Handler component. Manipulation of the argument filter[brandid] leads to SQL injection.
A critical vulnerability was found in IBOS OA version 4.5.5, allowing SQL injection through manipulation of the file ?r=recruit/bgchecks/export&checkids=x.
A vulnerability was found in Byzoro Smart S85F Management Platform up to version 20230809, rated as problematic. The issue affects some unknown processing of the file /config/php.ini, leading to direct requests.
A critical vulnerability was found in IBOS OA version 4.5.5, affecting unknown code in the file ?r=recruit/contact/export&contactids=x. Manipulation of this code leads to SQL injection.
A critical vulnerability was found in D-Link DAR-8000-10 up to version 20230809, affecting the file /app/sys1.php. Manipulation of the cmd argument with input id leads to remote OS command injection.