CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A critical vulnerability was found in Ruijie RG-EW1200G 1.0(1)B1P5 related to improper access controls in the file /api/sys/set_passwd. An attacker can exploit this vulnerability remotely.
A vulnerability was found in Templatecookie Adlisting version 2.14.0, classified as problematic. It affects an unknown function of the file /ad-list of the Redirect Handler component, leading to information disclosure.
A critical vulnerability has been found in Tongda OA affecting unknown code in the file general/system/seal_manage/dianju/delete_log.php. Manipulation of the argument DELETE_STR leads to SQL injection.
A critical vulnerability was found in Tongda OA affecting the file general/system/seal_manage/iweboffice/delete_seal.php. Manipulation of the argument DELETE_STR leads to SQL injection.
CVE-2023-4158 involves a Cross-site Scripting (XSS) vulnerability that is stored in the GitHub repository omeka/omeka-s prior to version 4.0.3.
CVE-2023-4157 concerns improper neutralization of special elements in output used by a downstream component in the GitHub repository omeka/omeka prior to version 4.0.3.
The Ethereum Name Service (ENS) has a vulnerability that allows an attacker to reduce the expiration time of existing domains due to an integer overflow in the renew function. This issue exists in versions prior to 0.0.22 of the `@ensdomains/ens-contracts` package.
CVE-2023-38697 affects the HTTP/1 protocol implementation in the protocol-http1 library, which does not comply with RFC 9112 specifications regarding Content-Length and chunk size headers. Improper acceptance of header values can lead to desynchronization when forwarding through multiple HTTP parsers, creating risks of HTTP request smuggling and firewall bypassing.
Cypress-image-snapshot before version 8.0.2 allowed users to pass relative file paths for snapshot names, enabling access to files outside the project directory on the machine running the tests.
Zoho ManageEngine ADManager Plus version 7201 allows authenticated users to take over another user's account via sensitive information disclosure.
ECShop version 4.1.16 contains an arbitrary file deletion vulnerability in the Admin Panel.
In versions 4.0.0 to 8.1.1, the matrix-appservice-bridge library allows a malicious Matrix server to use a foreign user's MXID in an OpenID exchange, enabling impersonation of users via the provisioning API.
In versions prior to 1.0.1 of matrix-appservice-irc, an IRC bridge for Matrix, it is possible to craft a command with newlines that would not be properly parsed. This allows passing a string of commands as a channel name, which could then be executed by the IRC bridge bot.
A cross-site scripting (XSS) vulnerability was discovered in Creative Item Academy LMS version 6.0.
MeterSphere is an open-source continuous testing platform. Prior to version 2.10.4 LTS, some interfaces of the Cloud version of MeterSphere do not have configuration permissions, leading to sensitive information leakage by attackers.
HedgeDoc prior to version 1.9.9 allowed the creation of notes with an alias matching the ID of existing notes, effectively hiding the original notes. Users could exploit this vulnerability to manipulate note content and prevent access to original notes.
A heap out-of-bounds memory read flaw was found in the virtual NVMe device in QEMU. The QEMU process does not validate an offset provided by the guest before computing a host heap pointer, which can lead to the disclosure of arbitrary heap memory relative to an allocated buffer.
VMware Horizon Server contains an information disclosure vulnerability. A malicious actor with network access may be able to access information relating to the internal network configuration.
VMware Horizon Server contains a HTTP request smuggling vulnerability. A malicious actor with network access may be able to perform HTTP smuggle requests.
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to privilege escalation in versions up to and including 7.9.8 due to insufficient restriction on the 'get_header_values' function. This allows authenticated attackers with minimal permissions, such as an author, to modify their user role.