CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An issue has been discovered in GitLab EE affecting all versions from 14.1 before 16.0.8, from 16.1 before 16.1.3, and from 16.2 before 16.2.2. EE-licensed users could link any security policy project by its ID to projects or groups they have access to, potentially revealing the security project's configured security policies.
Sulu is an open-source PHP content management system based on the Symfony framework. The Admin Login form allows detection of which user (username, email) exists and which does not.
Pimcore has a path traversal vulnerability in the `AssetController::importServerFilesAction`, allowing an attacker to overwrite or modify sensitive files by manipulating the pimcore_log parameter.
The CVE-2023-3373 vulnerability in the GT21 and GS21 models of the GOT2000 and GOT SIMPLE series allows a remote unauthenticated attacker to hijack data connections or prevent legitimate users from establishing connections by guessing the listening port on the FTP server.
An issue in the delete function in the ActModelController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete models created by the Administrator.
Cross Site Scripting (XSS) vulnerability in sourcecodester Lost and Found Information System 1.0 allows remote attackers to execute arbitrary code via the First Name, Middle Name and Last Name fields on the Create User page.
Cross Site Scripting (XSS) vulnerability in sourcecodester Toll Tax Management System 1.0 allows remote attackers to run arbitrary code via the First Name and Last Name fields on the My Account page.
User enumeration is found in PHPJabbers Cleaning Business Software version 1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
PHPJabbers Cleaning Business Software version 1.0 is vulnerable to Cross Site Scripting (XSS) via the theme parameter of preview.php.
There is a Cross Site Scripting (XSS) vulnerability in the 'theme' parameter of preview.php in PHPJabbers Class Scheduling System 1.0.
The infotainment system in Renault Zoe EV 2021 vehicles in versions from 283C35202R to 283C35519R is vulnerable to attacks that can crash the system by sending arbitrary USB data via a USB device.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository pimcore/customer-data-framework prior to version 3.4.2, allowing for the storage of malicious code.
In the GitHub repository ikus060/rdiffweb prior to version 2.8.0, there is an issue with resource allocation without limits or throttling.
A use-after-free vulnerability was found in the cxgb4 driver in the Linux kernel. The bug occurs when the cxgb4 device is detaching, potentially leading to a system crash.
A use-after-free vulnerability was found in the smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is plugged in, allowing a local user to crash the system, causing a denial of service condition.
A vulnerability was discovered in the odoh-rs rust crate that stems from faulty logic during the parsing of encrypted queries. This issue occurs when processing encrypted query data received from remote clients, allowing an attacker to send specially crafted queries to targeted ODOH servers.
The Wrangler command line tool (<[email protected] or <[email protected]) was affected by a directory traversal vulnerability when running a local development server for Pages. This vulnerability enabled an attacker in the same network as the victim to connect to the local development server and access the victim's files present outside of the directory for the development server.
A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests. There is no check for the value of `src_len` and `dst_len`, potentially leading to a heap buffer overflow when the two values differ.
WebBoss.io CMS version 3.7.0.1 contains a stored cross-site scripting (XSS) vulnerability.
WebBoss.io CMS version 3.7.0.1 contains a stored Cross-Site Scripting (XSS) vulnerability due to lack of input validation and output encoding.