CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A use-after-free flaw was found in nfc_llcp_find_local in net/nfc/llcp_core.c in the Linux kernel. This flaw allows a local user with special privileges to impact a kernel information leak issue.
The Auto Location for WP Job Manager plugin before version 1.1 does not sanitize and escape some of its settings, which could allow high privilege users such as admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
The All-in-one Floating Contact Form WordPress plugin before version 2.1.2 does not sanitize and escape some of its settings, which could allow high privilege users such as admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
The vulnerability related to improper input validation in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations in OTRS Generic Interface modules allows any authenticated attacker to perform a host header injection for the ContentType header of the attachment.
An improper privilege check in the OTRS ticket move action in the agent interface allows any authenticated attacker to perform a move of a ticket without the needed permission.
An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request to inject javascript code in free text answers. This allows a cross site scripting attack while reading the replies as authenticated agent.
A critical vulnerability was found in phpscriptpoint Car Listing version 1.6, affecting unknown processing of the /search.php file of the GET Parameter Handler component. Manipulation of arguments such as brand_id, model_id, car_condition, car_category_id, body_type_id, fuel_type_id, transmission_type_id, year, mileage_start, mileage_end, country, state, city leads to SQL injection.
A critical vulnerability has been found in phpscriptpoint BloodBank 1.1, affecting an unknown function of the file /search of the POST Parameter Handler component. Manipulation of the arguments country/city/blood_group_id leads to SQL injection.
A critical vulnerability was found in OpenRapid RapidCMS up to version 1.3.1, affecting unknown code in the file /admin/upload.php. Manipulation of the 'file' argument leads to unrestricted file uploads.
A critical vulnerability has been found in SourceCodester Lost and Found Information System version 1.0. It affects an unknown functionality of the file /classes/Master.php?f=delete_category, where manipulation of the argument id leads to SQL injection.
A vulnerability has been found in NxFilter version 4.3.2.5, affecting unknown code in the user.jsp file. The manipulation leads to cross-site request forgery, which can be initiated remotely.
A vulnerability has been identified in DedeBIZ 6.2.10 that allows for SQL injection through manipulation of the sqlquery argument in the /admin/sys_sql_query.php file. The attack can be launched remotely, and its complexity is relatively high.
A critical vulnerability was found in Dahua Smart Park Management up to version 20230713. It affects unknown code in the file /emap/devicePoint_addImgIco?hasSubsystem=true, leading to unrestricted file uploads.
A directory traversal issue in the URL decoder of librsvg before version 2.56.3 could be exploited by local or remote attackers to disclose files from the local filesystem outside of the expected area.
Datalust Seq before 2023.2.9489 allows insertion of sensitive information into an externally accessible file or directory. This is exploitable only when external (SQL Server or PostgreSQL) metadata storage is used.
A critical vulnerability has been found in IBOS OA version 4.5.5, affecting an unknown functionality of the file /?r=recruit/resume/edit&op=status of the Interview Handler component. Manipulation of the argument resumeid leads to SQL injection.
A vulnerability has been found in Dapr that allows bypassing API token authentication. An attacker could craft a well-formed HTTP request that is accepted by Dapr, even if the API token is invalid or missing.
KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leaks password hashes of users, including admins, which may allow an attacker to crack them.
The `ckeditor-wordcount-plugin` for CKEditor4 is susceptible to cross-site scripting (XSS) when switching to source code mode. This issue has been addressed in version 1.17.12 of the plugin.
Indico, a web-based event management tool, has a Cross-Site Scripting vulnerability in confirmation prompts used for deleting content. Exploitation requires someone with submission privileges to attempt to delete content, creating an attack risk.