CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.05)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2023-37215 affects the JBL multibeam 5.1 soundbar, which uses hard-coded credentials. This may allow unauthorized access to the device.
An issue in the delete function in the OaNotifyController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete notifications created by Administrators.
Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, unauthorized users could obtain information about restricted-visibility topic tags.
Discourse is an open source discussion platform that prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches did not impose an upper limit on limit parameters in multiple controller actions. This lack of restriction may allow users to generate database queries that could exhaust server resources.
Discourse is an open source discussion platform, where prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a malicious user can delay the defer queue processing on sites hosted in the same multisite installation.
Discourse is an open source discussion platform, where prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a malicious user can edit a post in a topic and cause a DoS with a carefully crafted edit reason.
In the Discourse discussion platform prior to version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a CSP (Content Security Policy) nonce reuse vulnerability was discovered that could allow cross-site scripting (XSS) attacks to bypass CSP protection for anonymous users. Version 3.1.0.beta7 contains a patch.
A critical vulnerability was found in Cafe Billing System 1.0, affecting an unknown functionality of the file index.php in the Order Handler component. Manipulation of the argument id leads to SQL injection.
A critical vulnerability was found in the Simple Online Mens Salon Management System 1.0. Manipulation of the 'id' argument in the file /admin/?page=user/manage_user&id=3 leads to SQL injection.
Several WordPress plugins by Inisev are vulnerable to Cross-Site Request Forgery, allowing unauthorized installation of plugins due to a missing nonce check in the handle_installation function. Attackers can exploit this vulnerability to install plugins if they can trick a site administrator.
A logic issue was addressed with improved state management. This vulnerability could allow a website to track sensitive user information.
A critical vulnerability was found in phpscriptpoint RecipePoint 1.9, affecting an unknown part of the file /recipe-result. Manipulation of the arguments text/category/type/difficulty/cuisine/cooking_method leads to SQL injection.
Zoho ManageEngine Support Center Plus version 14001 and below is vulnerable to stored XSS in the products module.
An unhandled error in Vault Enterprise's namespace creation may cause the Vault process to crash, potentially resulting in denial of service.
A cross-site scripting (XSS) vulnerability in PHPGurukul Online Fire Reporting System Using PHP and MySQL 1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the website title field.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository omeka/omeka-s prior to version 4.0.2, allowing for the storage of malicious code.
A Server-Side Request Forgery (SSRF) vulnerability exists in the GitHub repository omeka/omeka-s prior to version 4.0.2. This may lead to unauthorized access to internal server resources.
CVE-2023-3980 involves a Cross-site Scripting (XSS) vulnerability that is stored in the GitHub repository omeka/omeka-s prior to version 4.0.2.
A cross-site scripting (XSS) vulnerability in PHPGurukul Online Fire Reporting System Using PHP and MySQL 1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the team name, leader, and member fields.
An Open Redirect vulnerability has been found in IceWarp MailServer Deep Castle 2 Update 1 (13.0.1.2) via the referer parameter. An attacker can exploit this flaw to redirect users to a malicious website.