CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A critical vulnerability was found in SourceCodester Resort Reservation System version 1.0. Manipulation of the 'id' argument in the manage_user.php file leads to SQL injection, which can be executed remotely.
A critical vulnerability has been found in SourceCodester Resort Reservation System version 1.0. Manipulation of the 'page' argument in the index.php file leads to file inclusion, which can be exploited remotely.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository cockpit-hq/cockpit prior to version 2.6.3, allowing for the storage of malicious code.
A critical vulnerability was found in SourceCodester Pharmacy Management System version 1.0. It affects an unknown functionality of the file manage_website.php, leading to unrestricted file uploads.
A critical vulnerability was found in SourceCodester Online Hospital Management System version 1.0. Manipulation of the loginid and password arguments in the patientlogin.php file leads to SQL injection.
A vulnerability has been found in SourceCodester Inventory Management System 1.0 affecting unknown code of the file edit_update.php of the Password Handler component. Manipulation of the argument user_id leads to improper access controls.
A critical vulnerability has been found in SourceCodester Free Hospital Management System for Small Practices 1.0. The issue affects some unknown functionality of the file /vm/admin/delete-doctor.php?id=2 of the Redirect Handler component, leading to enforcement of unwanted workflow.
A critical vulnerability has been found in SourceCodester Free Hospital Management System for Small Practices version 1.0. Manipulation of the 'id' argument in the file /vm/doctor/doctors.php?action=view leads to SQL injection, which can be executed remotely.
All versions of Apache Roller have insufficient input validation and sanitation in the category name, website about, and file upload features, allowing an authenticated user to perform an XSS attack.
A critical vulnerability was found in SourceCodester Hospital Management System version 1.0. Manipulation of the 'time' argument in the appointmentapproval.php file leads to SQL injection.
Insufficient session expiration in the GitHub repository admidio/admidio prior to version 4.2.11 may lead to unauthorized access.
A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0, allowing absolute path traversal via the FileDirectory argument in the file Service/FileHandler.ashx. The attack can be initiated remotely, and the exploit has been publicly disclosed.
The HTTP Headers plugin by Dimitar Ivanov in versions up to 1.18.11 has a stored Cross-Site Scripting (XSS) vulnerability with admin privileges.
The WP-buy WP Content Copy Protection & No Right Click plugin versions up to 3.5.5 contains a stored Cross-Site Scripting (XSS) vulnerability with admin-level permissions. An attacker can exploit this vulnerability to inject malicious scripts that will be executed in the context of users visiting the site.
The My Content Management plugin versions up to 1.7.6 has a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will be executed in the victim's browser context.
The David Lingren Media Library Assistant plugin versions up to 3.0.7 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.
A vulnerability was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0 that allows an attacker to remotely manipulate the Files argument, leading to path traversal. The attack can be initiated remotely.
A Cross-site Scripting (XSS) vulnerability is reflected in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git, allowing attackers to inject malicious code into the application.
A critical vulnerability was found in Ruijie RG-EW1200G 1.0(1)B1P5 related to improper access controls in the file /api/sys/set_passwd. An attacker can exploit this vulnerability remotely.