CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The WP-Cirrus plugin versions up to 0.6.11 contain a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will be executed in the victim's browser context.
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.4). The affected applications accept unauthenticated file write messages.
In PHOENIX CONTACT's TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 and CLOUD CLIENT 1101T-TX/TX prior to 2.06.10, an authenticated remote attacker with admin privileges could upload a crafted XML file, leading to a denial-of-service.
In SAP BusinessObjects Business Intelligence version 420, if a user logs into a specific program, under certain specific conditions memory may not be cleared properly, which could allow an attacker to access user credentials.
In SAP Supplier Relationship Management versions 600, 602, 603, 604, 605, 606, 616, 617, there is a vulnerability that allows an unauthorized attacker to discover information related to SRM within Vendor Master Data. This information could be used to tailor attacks against SRM.
SAP NetWeaver Application Server ABAP and ABAP Platform in versions from 700 to 804 do not perform necessary authorization checks for an authenticated user, resulting in privilege escalation. This could allow an attacker to access sensitive information that can be used in a subsequent serious attack.
In SAP NetWeaver Process Integration versions SAP_XIESR 7.50, SAP_XITOOL 7.50, SAP_XIAF 7.50, insufficiently encoded user-controlled inputs may lead to a Cross-Site Scripting (XSS) attack. Successful exploitation could impact the confidentiality and integrity of the system.
SAP Business One (Service Layer) version 10.0 allows an authenticated attacker with deep knowledge to perform certain operations to access unintended data over the network.
Under certain conditions, SAP Commerce API (OCC) in versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211 allows an attacker to access information that would otherwise be restricted. Successful exploitation could lead to a high impact on confidentiality.
SAP PowerDesigner version 16.7 queries all password hashes in the backend database and compares them with the user-provided one during login attempts. This may allow an attacker to access password hashes from the client's memory.
PrestaShop is an open source e-commerce application. Prior to version 8.1.1, it was possible to delete files from the server via the CustomerMessage API.
PrestaShop prior to version 8.1.1 allows for file deletion from the server using the Attachments controller and the Attachments API. Version 8.1.1 contains a patch for this issue.
PrestaShop prior to version 8.1.1 contained the `displayAjaxEmailHTML` method that could be exploited to read any file on the server, potentially even outside of the project if the server is not correctly configured.
PrestaShop prior to version 8.1.1 has a vulnerability in the back office that allows file compromise through a path traversal attack. This can be achieved by replaying the import file deletion query with a specified file path that exploits this vulnerability.
ScanCode.io prior to version 32.5.1 has a command injection vulnerability in the docker fetch process. It allows appending malicious commands in the `docker_reference` parameter, leading to unauthorized command execution.
A critical vulnerability was found in SourceCodester Inventory Management System version 1.0. The issue affects some unknown processing of the file ex_catagory_data.php, leading to SQL injection.
PrestaShop prior to version 8.1.1 had an SQL injection vulnerability in the product search field on the product page in the admin panel. Version 8.1.1 includes a patch for this issue.
Cryptomator version 1.9.2 allows local privilege escalation for low privileged users via the `repair` function in the MSI installer. The issue arises from the MSI's repair function spawning a SYSTEM Powershell without the `-NoProfile` parameter, leading to the loading of the user's profile.
A critical vulnerability has been found in SourceCodester Inventory Management System version 1.0. Manipulation of the argument columns[1][data] leads to SQL injection, which can be exploited remotely.
Versions 0.2.15, 0.2.16, and 0.3.0 of the Vyper language have a flaw in the allocation of named re-entrancy locks, allowing cross-function re-entrancy in contracts. Version 0.3.1 contains a fix for this issue.