CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.05)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability exists in the Kirby content management system affecting versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6. It allows authenticated Panel users or external visitors to upload files with unknown extensions, potentially leading to the execution of malicious code in victims' browsers. The issue has been patched in newer versions of Kirby.
A Cross-site Scripting (XSS) vulnerability is reflected in the GitHub repository jgraph/drawio prior to version 21.6.3.
A vulnerability in the Kirby content management system related to XML External Entities (XXE) exists in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6. This vulnerability only affects Kirby sites that use the `Xml` data handler or the `Xml::parse()` method in site or plugin code.
The MF Gig Calendar plugin versions <= 1.2 has a stored Cross-Site Scripting (XSS) vulnerability for users with contributor privileges and above.
The WpStream plugin has a Cross-Site Request Forgery (CSRF) vulnerability, allowing unauthorized actions on behalf of the user. This issue affects versions from n/a to 4.5.4.
The wpShopGermany IT-RECHT KANZLEI plugin versions <= 1.7 has an authenticated stored Cross-Site Scripting (XSS) vulnerability.
The Gravity Master Custom Field for WP Job Manager plugin versions <= 1.1 has an authenticated (admin+) stored Cross-Site Scripting (XSS) vulnerability.
The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized data modification due to insufficient restrictions on the 'apg_profile_update' function in versions up to and including 1.9. This allows authenticated attackers with subscriber-level permissions or above to arbitrarily update user metas.
The issue was addressed with additional permissions checks. An app may be able to access user-sensitive data.
A permissions issue was addressed with additional restrictions. An app may be able to modify protected parts of the file system.
A logic issue was addressed with improved checks in macOS and iOS. An app may be able to cause a denial-of-service.
The issue was addressed with improved checks. Processing a 3D model may result in disclosure of process memory.
A logic issue was identified in macOS that could allow apps to access user-sensitive data. This issue is fixed in macOS Monterey 12.6.8, macOS Ventura 13.5, and macOS Big Sur 11.7.9.
The issue was addressed with improved checks. Processing a 3D model may result in disclosure of process memory.
The issue involves the potential for an app to modify sensitive kernel state. It has been addressed with improved state management in Apple operating systems.
The issue was addressed with improved checks. Processing web content may disclose sensitive information.
A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Ventura 13.5.
This issue was addressed with improved data protection. An app may be able to modify protected parts of the file system.
Yasm v1.3.0.78 is prone to NULL Pointer Dereference in /libyasm/intnum.c and /elf/elf.c. An attacker can exploit this vulnerability to cause a denial of service via a crafted file.
Version 3.4.4 of October CMS contains a vulnerability that allows arbitrary file uploads, enabling attackers to execute arbitrary code via a crafted file.