CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Netgear DGN3500 version 1.1.00.37 was found to have a buffer overflow vulnerability via the http_password parameter in setup.cgi.
In the kadm_rpc_xdr.c library in MIT Kerberos 5 before 1.20.2 and 1.21.x before 1.21.1, there is a bug related to freeing an uninitialized pointer. A remote authenticated user can trigger a kadmind crash.
A critical vulnerability was found in SourceCodester Inventory Management System 1.0, affecting an unknown part of the file catagory_data.php. Manipulation of the argument columns[1][data] leads to SQL injection.
A vulnerability in Microsoft Edge (Chromium-based) allows for a security feature bypass. An attacker could exploit this flaw to gain access to protected resources.
CVE-2023-38045 describes an improper neutralization of input during web page generation in the oneVote component for Joomla, allowing Cross-site Scripting (XSS) targeting non-script elements.
The MultiParcels Shipping for WooCommerce plugin before version 1.15.4 does not sanitize and escape various parameters before outputting them back on the page, leading to a reflected Cross-Site Scripting (XSS) vulnerability. This can be exploited against high privilege users such as admins.
The Bubble Menu WordPress plugin before 3.0.5 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
The Quiz And Survey Master WordPress plugin before version 8.1.11 does not properly sanitize and escape question titles, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
The WPCode WordPress plugin before 2.0.13.1 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting vulnerability.
The WP Shopping Pages plugin for WordPress through version 1.14 lacks CSRF checks in some places and is missing sanitization and escaping, which could allow attackers to make logged in admins add Stored XSS payloads via a CSRF attack.
A flaw was found in the Linux kernel's TUN/TAP functionality, which could allow a local user to bypass network filters and gain unauthorized access to some resources. The issues stem from incorrect or incomplete patches for CVE-2023-1076.
In Fujitsu Software Infrastructure Manager (ISM) before version 2.8.0.061, authorization credentials are insecurely collected and stored in cleartext in the file /var/log/fujitsu/ServerViewSuite/ism/FirmwareManagement/FirmwareManagement.log. This occurs when users test the connection to a firmware repository or regularly authenticate against a configured remote firmware repository, if a backslash character is used in the user credentials (ID or password).
In the Contacts service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.
In the vowifi service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.
In Contacts Service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.
In the Contacts service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.
In ims service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.
In Contacts Service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.
In Contacts Service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.
A critical vulnerability has been found in SourceCodester Resort Reservation System version 1.0. Manipulation of the 'id' argument in the view_fee.php file leads to SQL injection, which can be exploited remotely.