CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server.
An issue in the delete function in the UserController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete the Administrator's role information.
A flaw was found in the USB Host Controller Driver framework in the Linux kernel. The usb_giveback_urb function has a logic loophole that leads to an endless loop when a specific malformed descriptor file is input, resulting in a denial of service.
The issue is that checking excessively long DH keys or parameters may be very slow. Applications using the functions DH_check(), DH_check_ex(), or EVP_PKEY_param_check() may experience long delays, which could lead to a Denial of Service attack if the keys or parameters are obtained from an untrusted source.
Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.
Fuge CMS v1.0 contains an Open Redirect vulnerability in member/RegisterAct.java.
Fuge CMS version 1.0 contains an Open Redirect vulnerability found in /front/ProcessAct.java.
A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Webmin 2.021 in the System Logs Viewer functionality. The vulnerability allows an attacker to store a malicious payload in the configuration field, triggering the execution of the payload when saving the configuration or when accessing the System Logs Viewer page.
A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the configuration settings of the system logs functionality in Webmin 2.021. An attacker can store an XSS payload in the configuration settings of specific log files, leading to its execution whenever those log files are accessed.
A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in Webmin 2.021 in the package search functionality. An attacker can inject a malicious payload in the 'Search for Package' field, leading to the execution of arbitrary JavaScript code within the context of the victim's browser.
A Cross-Site Scripting (XSS) vulnerability was discovered in Webmin 2.021 in the HTTP Tunnel functionality when handling third-party domain URLs. An attacker can inject malicious code, leading to the execution of arbitrary JavaScript code within the context of the victim's browser.
A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Webmin 2.021 in the Users and Groups functionality. The issue occurs when an authenticated user adds a new user and inserts an XSS payload into the user's real name.
A Cross-site Scripting (XSS) Bypass vulnerability was discovered in the file upload functionality of Webmin 2.021. An attacker can bypass restrictions on uploading certain file types, such as .svg or .php, and inject malicious code.
An issue was discovered in Webmin 2.021 related to the download functionality, allowing an attacker to exploit a Cross-Site Scripting (XSS) vulnerability. By providing a crafted download path containing a malicious payload, an attacker can inject arbitrary code, which is then executed within the context of the victim's browser when the download link is accessed.
A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Webmin 2.021 in the Users and Groups functionality, allowing an attacker to store a malicious payload in the Group Name field when creating a new group.
An issue was discovered in Webmin 2.021 that allows for a stored Cross-Site Scripting (XSS) attack to achieve Remote Command Execution (RCE) through the Users and Group's real name parameter.
Vound Intella Connect version 2.6.0.3 is vulnerable to stored Cross-site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious scripts that will be executed in the victim's browser context.
Vound Intella Connect version 2.6.0.3 has an Open Redirect vulnerability that can be exploited to redirect users to malicious websites.
A vulnerability in Outline.cc for Poppler prior to version 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) via a crafted PDF file in OutlineItem::open.
The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when processing its tab actions, which could allow attackers to make logged in admins email pre-orders customer, change the released date, mark all pre-orders of a specific product as complete or cancel via CSRF attacks.