CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Zoho ManageEngine Support Center Plus version 14001 and below is vulnerable to stored XSS in the products module.
An unhandled error in Vault Enterprise's namespace creation may cause the Vault process to crash, potentially resulting in denial of service.
A cross-site scripting (XSS) vulnerability in PHPGurukul Online Fire Reporting System Using PHP and MySQL 1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the website title field.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository omeka/omeka-s prior to version 4.0.2, allowing for the storage of malicious code.
A Server-Side Request Forgery (SSRF) vulnerability exists in the GitHub repository omeka/omeka-s prior to version 4.0.2. This may lead to unauthorized access to internal server resources.
CVE-2023-3980 involves a Cross-site Scripting (XSS) vulnerability that is stored in the GitHub repository omeka/omeka-s prior to version 4.0.2.
A cross-site scripting (XSS) vulnerability in PHPGurukul Online Fire Reporting System Using PHP and MySQL 1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the team name, leader, and member fields.
An Open Redirect vulnerability has been found in IceWarp MailServer Deep Castle 2 Update 1 (13.0.1.2) via the referer parameter. An attacker can exploit this flaw to redirect users to a malicious website.
A vulnerability in the Kirby content management system related to the lack of password length limitation in authentication endpoints was discovered. Attackers could provide a password up to the server's maximum request body length, potentially leading to CPU and memory resource exhaustion.
A vulnerability exists in the Kirby content management system affecting versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6. It allows authenticated Panel users or external visitors to upload files with unknown extensions, potentially leading to the execution of malicious code in victims' browsers. The issue has been patched in newer versions of Kirby.
A Cross-site Scripting (XSS) vulnerability is reflected in the GitHub repository jgraph/drawio prior to version 21.6.3.
A vulnerability in the Kirby content management system related to XML External Entities (XXE) exists in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6. This vulnerability only affects Kirby sites that use the `Xml` data handler or the `Xml::parse()` method in site or plugin code.
The MF Gig Calendar plugin versions <= 1.2 has a stored Cross-Site Scripting (XSS) vulnerability for users with contributor privileges and above.
The WpStream plugin has a Cross-Site Request Forgery (CSRF) vulnerability, allowing unauthorized actions on behalf of the user. This issue affects versions from n/a to 4.5.4.
The wpShopGermany IT-RECHT KANZLEI plugin versions <= 1.7 has an authenticated stored Cross-Site Scripting (XSS) vulnerability.
The Gravity Master Custom Field for WP Job Manager plugin versions <= 1.1 has an authenticated (admin+) stored Cross-Site Scripting (XSS) vulnerability.
The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized data modification due to insufficient restrictions on the 'apg_profile_update' function in versions up to and including 1.9. This allows authenticated attackers with subscriber-level permissions or above to arbitrarily update user metas.
The issue was addressed with additional permissions checks. An app may be able to access user-sensitive data.
A permissions issue was addressed with additional restrictions. An app may be able to modify protected parts of the file system.
A logic issue was addressed with improved checks in macOS and iOS. An app may be able to cause a denial-of-service.