CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Versions of Royal Elementor Addons Pro below 1.7.1041 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
There is an unauthenticated local file inclusion vulnerability in Atomlab versions <= 2.4.5.
There is an unauthenticated PHP Object Injection vulnerability in SingleMalt <= 1.5 versions.
Hiroshi versions up to 1.5.1 are vulnerable to unauthenticated PHP object injection.
Uppercase versions below 1.2.2 are vulnerable to unauthenticated local file inclusion.
There is an unauthenticated PHP Object Injection vulnerability in Konsept <= 1.9 versions.
There is an unauthenticated local file inclusion vulnerability in Solene Core versions <= 2.3.2.
In Alukas versions below 3.0.0, there is an unauthenticated PHP Object Injection vulnerability.
There is an unauthenticated PHP Object Injection vulnerability in PressMart versions <= 1.2.26.
A buffer overflow vulnerability exists in Zephyr's Bluetooth Classic Hands-Free Profile (HFP) driver. The cind_handle_values() function fails to validate the index against the 20-element ind_table[] array, allowing a remote attacker (malicious AG) to write a controlled value out of bounds, causing memory corruption and potential denial of service of the Bluetooth stack.
The EMV JobBank has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.
There is an unauthenticated local file inclusion vulnerability in Line Agency versions <= 1.3.1.
Versions of Etude up to 1.6 are vulnerable to unauthenticated local file inclusion. An attacker can exploit this vulnerability to gain access to system files.
There is an unauthenticated local file inclusion vulnerability in Eventicity versions <= 1.5.
Gunslinger versions up to 1.7 are vulnerable to unauthenticated local file inclusion.
There is an unauthenticated local file inclusion vulnerability in Skyward versions <= 1.10.
Versions of Granola <= 1.13 are vulnerable to unauthenticated local file inclusion, which may lead to the exposure of sensitive data.
Versions of Gamic <= 1.15 are vulnerable to unauthenticated local file inclusion. An attacker can exploit this vulnerability to gain access to system files.
There is a vulnerability in Preservation <= 1.10 that allows unauthenticated local file inclusion.
Versions of SweetDate Core below 1.1.5 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.