CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to takeover GitLab Pages with unique domain URLs if the random string added was known.
A vulnerability in PHP Jabbers Cleaning Business 1.0 allows for cross-site scripting (XSS) attacks through manipulation of the index argument in the /index.php file.
A vulnerability was found in PHP Jabbers Night Club Booking Software 1.0, rated as problematic. This issue affects some unknown processing of the file /index.php, leading to cross-site scripting attacks.
A vulnerability was found in PHP Jabbers Service Booking Script version 1.0 that leads to cross-site scripting (XSS) attacks through manipulation of the index argument in the /index.php file.
A vulnerability was found in PHP Jabbers Shuttle Booking Software version 1.0 that leads to cross-site scripting (XSS) attacks through manipulation of the /index.php file. The attack can be initiated remotely.
A race condition exists within a thread in the GitHub repository answerdev/answer prior to v1.1.1, which may lead to unpredictable application behavior.
Missing authorization in GitHub repository answerdev/answer prior to version 1.1.1 may lead to unauthorized access to resources.
A vulnerability was found in PHP Jabbers Bus Reservation System 1.1 that allows cross-site scripting (XSS) attacks through manipulation of the index/pickup_id argument in the /index.php file.
An access control issue in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to remotely open and close doors managed by the platform by sending a crafted web request.
In Control ID IDSecure versions 4.7.26.0 and prior, some API routes exist that exfiltrate sensitive information and passwords to users accessing these API routes.
SpiderControl SCADA Webserver versions 2.08 and prior are vulnerable to path traversal. An attacker with administrative privileges could overwrite files on the webserver using the HMI's upload file feature.
A segmentation violation was discovered in the ngiflib library via the function SDL_LoadAnimatedGif at ngiflibSDL.c. This vulnerability is triggered when running the program SDLaffgif.
In ngiflib version with commit fb271, a segmentation violation was discovered in the 'main' function at gif2tag.c. This vulnerability is triggered when running the gif2tga program.
Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.
A Cross Site Scripting (XSS) vulnerability in the GatesAIr Flexiva FM Transmitter/Exciter FAX 150W allows a remote attacker to execute arbitrary code via a crafted script in the web application dashboard.
Certain F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account. The predictable nature of the password allows an authenticated user with TMSH access to the BIG-IP system, or anyone with physical access to the FIPS HSM, to generate the correct password.
CVE-2023-38423 describes a cross-site scripting (XSS) vulnerability in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.
An authenticated attacker with guest privileges or higher can cause the iControl SOAP process to terminate by sending undisclosed requests.
Audit logs on F5OS-A may contain undisclosed sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
OXID eShop Enterprise Edition versions 6.5.0 – 6.5.2 before 6.5.3 allows uploading files with modified headers in the administration area. An attacker can upload a file with a modified header, leading to an HTTP Response Splitting attack.