CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by a Use-After-Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR.
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR.
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by a Use-After-Free vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Adobe XMP Toolkit versions 2022.06 are affected by an Uncontrolled Resource Consumption vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user, requiring user interaction to open a malicious file.
The Simple Light Weight Social Share plugin versions <= 2.0 has a stored Cross-Site Scripting (XSS) vulnerability with admin+ authorization. An attacker can exploit this vulnerability to inject malicious scripts that will be executed in the user's browser context.
The Noël Jackson Art Direction plugin versions <= 0.2.4 has a stored Cross-Site Scripting (XSS) vulnerability for users with contributor privileges and above.
The EmbedPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'embedpress_calendar' shortcode in versions up to and including 3.8.2 due to insufficient input sanitization and output escaping on user supplied attributes.
The EmbedPress plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the 'admin_post_remove' and 'remove_private_data' functions in versions up to and including 3.8.2. This allows authenticated attackers with subscriber privileges or above to delete plugin settings.
The Smartypants SP Project & Document Manager plugin versions up to 4.67 contains a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will be executed in the victim's browser context.
The AnsPress plugin versions up to 4.3.0 contain a stored Cross-Site Scripting (XSS) vulnerability in the context of authorization (editor+).
An issue was discovered in the Clario VPN client through 5.9.1.1662 for macOS, which insecurely configures the operating system, resulting in local network traffic being sent in plaintext outside the VPN tunnel. This allows an adversary to trick the victim into sending arbitrary IP traffic in plaintext.
An issue was discovered in the Clario VPN client through 5.9.1.1662 for macOS, causing all IP traffic to the VPN server's IP address to be sent in plaintext, even if not generated by the VPN client. This allows an adversary to trick the victim into sending plaintext traffic and deanonymize them.
WireGuard client version 0.5.3 on Windows insecurely configures the operating system and firewall, leading to the blocking of traffic to a local network using non-RFC1918 IP addresses. This allows an adversary to trick the victim into blocking IP traffic to selected addresses and services even while the VPN is enabled.
An issue was discovered in LWsystems Benno MailArchiv version 2.10.1 that allows attackers to exploit an XSS vulnerability via JavaScript content in a mailbox.
The Crash Reporter (crash_reporter.php) component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 mishandles input sanitization.
In OPNsense Community Edition before version 23.7 and Business Edition before version 23.4.2, there is a cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php that allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
A reflected XSS vulnerability in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 in the component /ui/diagnostics/log/core/ allows attackers to inject arbitrary JavaScript via the URL path.