CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An issue in TPLink Smart Bulb Tapo series (L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14) allows a remote attacker to obtain sensitive information via the IV component in the AES128-CBC function.
An issue in TPLink Smart Bulb Tapo series (L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application before 2.8.14) allows a remote attacker to obtain sensitive information via the TSKEP authentication function.
An issue in TPLink Smart Bulb Tapo series and Tapo Application allows a remote attacker to obtain sensitive information via the authentication code for the UDP message.
Jenkins Fortify Plugin version 22.1.38 and earlier does not escape the error message for a form validation method, resulting in an HTML injection vulnerability.
A missing permission check in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method.
The Fortify Plugin in Jenkins version 22.1.38 and earlier contains a cross-site request forgery (CSRF) vulnerability that allows attackers to connect to an attacker-specified URL using credentials IDs obtained through another method.
A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in the Linux Kernel, which may lead to a denial of service.
In Devolutions Remote Desktop Manager version 2023.2.19 and earlier, improper access controls in the entry duplication component allow an authenticated user, under specific circumstances, to inadvertently share their personal vault entry with shared vaults via an incorrect vault in the duplication write process.
A flaw was found in openshift-logging LokiStack where the key used for caching is too broad, relying solely on the token. This allows a user with a valid token for one action to execute other actions as long as the authorization for the original action is still cached.
The MultiParcels Shipping For WooCommerce plugin before version 1.15.4 does not sanitize and escape a parameter before outputting it back on the page, leading to a Reflected Cross-Site Scripting vulnerability. This could be exploited against high privilege users such as admins.
The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting vulnerability.
The Bit Assist WordPress plugin before version 1.1.9 does not sanitize and escape some of its settings, which could allow high privilege users such as admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
The MultiParcels Shipping For WooCommerce plugin before version 1.15.2 lacks CSRF verification when deleting a shipment, allowing attackers to delete arbitrary shipments via a CSRF attack by any logged-in user.
Cross Site Scripting vulnerability in ZeroWdd studentmanager v.1.0 allows a remote attacker to execute arbitrary code via the username parameter in the student list function.
Critters versions 0.0.17-0.0.19 have an issue when parsing HTML, which leads to a potential cross-site scripting (XSS) vulnerability.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the GitHub repository wallabag/wallabag prior to version 2.6.3. This allows attackers to send unauthorized requests on behalf of users.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the GitHub repository wallabag/wallabag prior to version 2.6.3. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.
A Cross-site Scripting (XSS) vulnerability is reflected in the GitHub repository pimcore/pimcore prior to version 10.6.8.
A cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product with administrative privileges.
A cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and prior to 5.2.3L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user using the product.