CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An issue was discovered in TechView LA-5570 Wireless Gateway version 1.0.19_T53, allowing physical attackers to gain escalated privileges via a telnet connection.
An issue was discovered in TECHView LA5570 Wireless Gateway version 1.0.19_T53, allowing physical attackers to gain escalated privileges via the UART interface.
In jupyter-server, improper cross-site credential checks on `/files/` URLs could allow exposure of certain file contents or accessing files when opening untrusted files. This issue has been addressed in version `2.7.2`.
The vulnerability in jupyter-server allows for an Open Redirect attack, enabling redirection of users to arbitrary sites after logging into a Jupyter server. Maliciously crafted login links can lead to unauthorized redirects.
Cross Site Scripting vulnerability in Badaso v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the title parameter in the new book and edit book function.
A stored cross-site scripting (XSS) vulnerability in the Create function of Zenario CMS v9.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Menu navigation text field.
Spinnaker, an open source multi-cloud continuous delivery platform, has a logging issue where GitHub status is always logged in full. This may lead to the exposure of GitHub tokens in the logging system.
Multiple cross-site scripting (XSS) vulnerabilities in the inventory management system version 1.0 allow attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Name, Address, and Company parameters under the Add Member section.
GPAC v2.3-DEV-rev449-g5948e4f70-master was found to contain a heap-use-after-free vulnerability in the gf_bs_align function at bitstream.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by supplying a crafted file.
Cross Site Scripting vulnerability in Spipu HTML2PDF before v.5.2.8 allows a remote attacker to execute arbitrary code via a crafted script to the forms.php.
A stored cross-site scripting (XSS) vulnerability in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Add New parameter under the New Buy section.
There is a Cross Site Scripting (XSS) vulnerability in the 'theme' parameter of preview.php in PHPJabbers Callback Widget v1.0.
There is a Cross Site Scripting (XSS) vulnerability in the message parameter of index.php in PHPJabbers Ticket Support Script v3.2.
There is a Cross Site Scripting (XSS) vulnerability in the 'action' parameter of index.php in PHPJabbers Make an Offer Widget v1.0.
PHPJabbers Fundraising Script v1.0 is vulnerable to Cross Site Scripting (XSS) via the 'action' parameter of index.php.
There is a Cross Site Scripting (XSS) vulnerability in the 'action' parameter of index.php in PHPJabbers Yacht Listing Script v1.0.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository omeka/omeka-s prior to version 4.0.4, allowing for the storage of malicious code.
Improper authorization of an index containing sensitive information exists in the GitHub repository omeka/omeka-s prior to version 4.0.4.
A critical vulnerability has been found in Bettershop LaikeTui, allowing unrestricted file uploads through manipulation of functionality in the file index.php?module=api&action=user&m=upload. The attack can be launched remotely.
A critical vulnerability was found in SourceCodester Inventory Management System version 1.0. Manipulation of the argument columns[0][data] in the staff_data.php file leads to SQL injection, which can be executed remotely.