CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Valiano Unite Gallery Lite plugin versions <= 1.7.61 has a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+).
The Joaquín Ruiz Easy Admin Menu plugin versions <= 1.3 has a stored Cross-Site Scripting (XSS) vulnerability with admin authorization.
The nuajik plugin versions <= 0.1.0 has a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+).
The gsmith Cookie Monster plugin versions <= 1.51 has a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+).
AffiliateWP for WordPress is vulnerable to unauthorized data modification due to a missing capability check in the 'affwp_activate_addons_page_plugin' function called via an AJAX action in versions up to and including 2.14.0. This allows authenticated attackers with subscriber-level access and above to activate arbitrary plugins.
An issue has been discovered in GitLab affecting all versions before 16.2.0. Committing directories containing LF character results in 500 errors when viewing the commit.
The Email Encoder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'eeb_mailto' shortcode in versions up to and including 2.1.8 due to insufficient input sanitization and output escaping on user supplied attributes.
The Slimstat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'slimstat' shortcode in versions up to and including 5.0.9 due to insufficient input sanitization and output escaping on user supplied attributes.
AudimexEE version 15.0 was found to contain a full path disclosure vulnerability.
AudimexEE v15.0 was found to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the Show Kai Data component.
A Stored Cross-Site Scripting (XSS) vulnerability in Usermin 2.001's SSH configuration tab allows remote attackers to inject arbitrary web scripts or HTML via options for the host value while editing host options.
Badaso versions 0.0.1 through 2.9.7 have a Cross Site Scripting vulnerability that allows a remote attacker to execute arbitrary code via a crafted payload to the rack number parameter in the add new rack function.
An improper authorization vulnerability exists where an authenticated, low privileged remote attacker could view a list of all the users available in the application.
A cross-site scripting (XSS) vulnerability in the device web interface of BDCOM OLT P3310D-2AC 10.1.0F Build 69083 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter.
CVE-2023-39268 in ArubaOS-Switch is a memory corruption vulnerability that could lead to unauthenticated remote code execution by receiving specially crafted packets. Successful exploitation allows arbitrary code execution as a privileged user on the underlying operating system.
An authenticated remote code execution vulnerability exists in ArubaOS-Switch. Successful exploitation results in a Denial-of-Service (DoS) condition in the switch.
An arbitrary file write vulnerability allows an authenticated, remote attacker with administrator privileges to alter logging variables to overwrite arbitrary files on the remote host with log data.
A pass-back vulnerability exists in the Nessus application before version 10.6.0, allowing an authenticated remote attacker with administrator privileges to uncover stored SMTP credentials.
In goauthentik, an open-source Identity Provider, affected versions with an enabled recovery flow allow an attacker to determine if a username exists. This issue only affects setups configured with a recovery flow.
OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In versions up to 5.9.0, during the verification of Cleartext Signed Messages, any data preceding the 'Hash: ...' header was ignored, allowing attackers to add arbitrary text that could be perceived as signed.