CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Shelly 4PM Pro four-channel smart switch version 0.11.0 allows an attacker to trigger a BLE out of bounds read fault condition, resulting in a device reload.
Verint Engagement Management version 15.3 Update 2023R2 is vulnerable to HTML injection via the user data form in the live chat.
In Liferay Portal versions 7.4.3.81 to 7.4.3.85 and Liferay DXP 7.4 updates 81 to 85, the organization selector does not check user permissions, allowing remote authenticated users to obtain a list of all organizations.
The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the 'tab_date' and 'tab_date_r' parameters in versions up to and including 5.2.3 due to insufficient input sanitization and output escaping.
An issue has been discovered in GitLab affecting all versions before 16.0.8, all versions starting from 16.1 before 16.1.3, and all versions starting from 16.2 before 16.2.2. The main branch of a repository with a specially designed name allows an attacker to create repositories with malicious code.
An issue has been discovered in GitLab EE affecting all versions from 15.11 prior to 16.2.2 which allows an attacker to spike the resource consumption resulting in DoS.
An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Access tokens may have been logged when a query was made to a specific endpoint.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. An invalid 'start_sha' value on merge requests page may lead to Denial of Service as Changes tab would not load.
An issue has been discovered in GitLab CE/EE affecting versions from 10.0 before 16.0.8, from 16.1 before 16.1.3, and from 16.2 before 16.2.2. A reflected XSS was possible when creating specific PlantUML diagrams, allowing attackers to perform arbitrary actions on behalf of victims.
An issue has been discovered in GitLab affecting all versions from 8.10 before 16.0.8, all versions from 16.1 before 16.1.3, and all versions from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated files via uploading a specially crafted file.
An issue in the delete function in the MenuController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete menus created by the Administrator.
Cross Site Scripting vulnerability in e107 v.2.3.2 allows a remote attacker to execute arbitrary code via the description function in the SEO project.
Insufficient validation of untrusted input in Themes in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially serve malicious content to a user via a crafted background URL.
Insufficient validation of untrusted input in Chromad in Google Chrome on ChromeOS prior to version 115.0.5790.131 allowed a remote attacker to execute arbitrary code via a crafted shell script.
Inappropriate implementation in Autofill in Google Chrome prior to version 115.0.5790.98 allowed a remote attacker to obfuscate security UI via a crafted HTML page.
Inappropriate implementation in Notifications in Google Chrome prior to version 115.0.5790.98 allowed a remote attacker to spoof the contents of media notifications via a crafted HTML page.
Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to version 115.0.5790.98 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Inappropriate implementation in Web API Permission Prompts in Google Chrome prior to version 115.0.5790.98 allowed a remote attacker to obfuscate security UI via a crafted HTML page.
Inappropriate implementation in Picture In Picture in Google Chrome prior to version 115.0.5790.98 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Inappropriate implementation in WebApp Installs in Google Chrome prior to version 115.0.5790.98 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page.