CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.05)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a cryptographic vulnerability that could allow an unauthenticated user to decrypt encrypted passwords into plaintext.
The Hijiri Custom Post Type Generator plugin versions <= 2.4.2 has an authenticated (admin+) reflected Cross-Site Scripting (XSS) vulnerability.
A vulnerability in matrix-react-sdk allows for the injection of malicious code through the Export Chat feature, leading to stored XSS attacks. An attacker can exploit this flaw to leak message contents, although the impact is limited to code running from the `null` origin.
In DPA version 2023.2, an XSS attack was possible due to insufficient input validation.
The MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce versions <= 3.9.5 contains an authenticated (editor+) stored Cross-Site Scripting (XSS) vulnerability.
The Replace Word plugin by David Pokorny in versions <= 2.1 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.
The PluginPress Shortcode IMDB plugin versions <= 6.0.8 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.
The WPAdmin AWS CDN plugin versions up to 2.0.13 contain a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of a logged-in user.
The RadiusTheme Classified Listing plugin versions up to 2.4.5 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.
The Media Library Helper plugin versions <= 1.2.0 has a Cross-Site Request Forgery (CSRF) vulnerability. This allows attackers to send unauthorized requests on behalf of users.
The Royal Elementor Addons plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to and including 1.3.70. The API key is added to the source code of any page running the MailChimp block, allowing unauthenticated attackers to obtain the MailChimp API key.
Several WordPress themes by DeoThemes are vulnerable to reflected Cross-Site Scripting (XSS) via breadcrumbs in various versions due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts on pages.
The ProfileGrid plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the 'pm_upload_csv' function in versions up to and including 5.5.1. This allows authenticated attackers with subscriber-level permissions or higher to import new users and update existing users.
CVE-2023-34143 describes an improper validation of certificate with host mismatch vulnerability in Hitachi Device Manager on Windows and Linux. This allows for a Man in the Middle attack, potentially leading to data interception.
Open Enclave SDK version 0.19.3 addresses two vulnerabilities. The first concerns improper sanitization of the `MXCSR` register on enclave entry, which can lead to MCDT attacks. The second involves the lack of sanitization of the `RFLAGS.AC` flag, allowing attackers to monitor unaligned memory accesses.
An issue was discovered in set_con2fb_map in the Linux kernel before version 6.2.12. The problem is that an assignment occurs only for the first vc, which can lead to desynchronization of the fbcon_registered_fb and fbcon_display arrays.
OpenRefine is a free, open source tool for data processing that contains a vulnerability allowing arbitrary code execution in the context of the OpenRefine process. A malicious OpenRefine project tar file can be exploited if a user is convinced to import it.
An issue in the emqx_sn plugin of EMQX v4.3.8 allows attackers to execute a directory traversal via uploading a crafted .txt file.
The discovered faust commit ee39a19 contains a stack overflow in the component boxppShared::print() at /boxes/ppbox.cpp.
A FPE vulnerability was discovered in master commit e4c878 via the component combine_inner at /pixman-combine-float.c.