CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A critical vulnerability was found in jeecgboot JimuReport up to version 1.6.0, related to an unknown functionality of the Template Handler component. Manipulation of this functionality leads to injection.
A critical vulnerability was found in SourceCodester Free and Open Source Inventory Management System version 1.0. Manipulation of the argument columns[0][data] in the file /index.php?page=member leads to SQL injection.
A critical vulnerability was found in OpenRapid RapidCMS version 1.3.1, affecting unknown processing of the file admin/run-movepass.php. Manipulation of the arguments password/password2 leads to weak password recovery.
A critical vulnerability has been found in OpenRapid RapidCMS version 1.3.1, affecting unknown code in the file admin/article-chat.php. Manipulation of the argument id leads to SQL injection.
A critical vulnerability was found in OpenRapid RapidCMS version 1.3.1, affecting an unknown part of the file template/default/category.php. Manipulation of the argument id leads to SQL injection.
A critical vulnerability has been found in Mini-Tmall up to version 20230811, affecting some unknown functionality of the file product/1/1?test=1&test2=2&. Manipulation of the argument orderBy leads to SQL injection.
A critical vulnerability was found in SourceCodester Free Hospital Management System for Small Practices 1.0. Manipulation of arguments in the file vm\patient\edit-user.php leads to SQL injection.
A critical vulnerability has been found in SourceCodester Free Hospital Management System for Small Practices. Manipulation of arguments in the file vm\doctor\edit-doc.php leads to SQL injection.
A critical SQL injection vulnerability was found in Free Hospital Management System for Small Practices 1.0 in the file booking-complete.php. An attacker can remotely manipulate the userid, apponum, or scheduleid parameters, leading to SQL injection.
A critical vulnerability was found in SourceCodester Free Hospital Management System for Small Practices version 1.0. Manipulation of the 'sheduledate' argument in the /patient/appointment.php file leads to SQL injection.
A critical vulnerability was found in SourceCodester Free Hospital Management System for Small Practices 1.0. Manipulation of the 'sheduledate' argument in the appointment.php file leads to SQL injection.
A vulnerability was found in SourceCodester Card Holder Management System 1.0 affecting an unknown functionality of the Minus Value Handler component. The manipulation leads to improper validation of specified quantity in input.
A critical vulnerability has been identified in SourceCodester Inventory Management System version 1.0. Manipulation of the 'customer' argument in the app/ajax/search_sales_report.php file leads to SQL injection, allowing for remote attacks.
A critical vulnerability was found in SourceCodester Inventory Management System version 1.0. Manipulation of the 'customer' argument in the file app/ajax/search_sell_paymen_report.php leads to SQL injection, allowing for remote attacks.
A critical vulnerability has been found in SourceCodester Inventory Management System 1.0, affecting some unknown processing of the file app/action/edit_update.php. Manipulation of the argument user_id leads to SQL injection.
An issue was discovered in MediaWiki before version 1.35.11 and in versions 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1 that allows bypassing the Bad image list (badFile) using the thumb parameter (Manualthumb) of the File syntax.
A Cross-site Scripting (XSS) reflected vulnerability exists in the GitHub repository cockpit-hq/cockpit prior to version 2.6.4.
Improper Input Validation in GitHub repository hamza417/inure prior to build88.
Missing authorization in the GitHub repository hamza417/inure prior to build88 may lead to unauthorized access to resources.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository cockpit-hq/cockpit prior to version 2.6.4, allowing for the storage of malicious code.