CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.05)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A critical vulnerability has been found in Campcodes Beauty Salon Management System version 1.0. Manipulation of the 'category' argument in the add-product.php file leads to SQL injection, allowing for remote attacks.
IBM Db2 for Linux, UNIX and Windows version 11.5 with a Federated configuration is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user with SYSADM privileges could overflow the buffer and execute arbitrary code on the system.
A critical vulnerability has been found in the House Rental and Property Listing application version 1.0, affecting unknown processing of the /index.php file. Manipulation of the keywords/location argument leads to SQL injection.
IBM InfoSphere Information Server version 11.7 could allow a remote attacker to obtain system information using a specially crafted query, which could aid in further attacks against the system.
A critical vulnerability has been found in Bylancer QuickOrder 6.3.7, affecting some unknown functionality of the file /blog in the GET Parameter Handler component. Manipulation of the argument s leads to SQL injection.
A critical vulnerability was found in Bylancer QuickQR version 6.3.7, affecting an unknown functionality of the file /blog in the GET Parameter Handler component. Manipulation of the argument s leads to SQL injection.
A critical vulnerability has been found in Bylancer QuickJob 6.1, affecting an unknown function of the GET Parameter Handler component. Manipulation of the keywords/gender argument leads to SQL injection.
A critical vulnerability was found in Bylancer QuickVCard 2.1, affecting unknown processing of the file /blog in the GET Parameter Handler component. Manipulation of the argument s leads to SQL injection.
A critical vulnerability was found in Bylancer QuickAI OpenAI 3.8.1, affecting unknown code in the /blog file of the GET Parameter Handler component. Manipulation of the argument s leads to SQL injection.
A critical vulnerability was found in Nesote Inout Blockchain EasyPayments 1.0, affecting an unknown function of the file /index.php/payment/getcoinaddress. Manipulation of the argument coinid leads to SQL injection.
A critical vulnerability has been found in the Lost and Found Information System version 1.0, affecting an unknown part of the file /classes/Master.php?f=save_item. Manipulation of the argument id leads to SQL injection.
A critical vulnerability was found in SourceCodester Lost and Found Information System version 1.0. The issue affects an unknown functionality of the file /classes/Master.php?f=save_inquiry, where manipulation of the argument id leads to SQL injection.
A critical vulnerability was found in AC Repair and Services System version 1.0. Manipulation of the 'id' argument in the file /classes/Master.php?f=delete_inquiry leads to SQL injection.
PNP4Nagios version 0.6.26 has a stored XSS vulnerability in the AJAX controller via the basket API and filters.
Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. An attacker may authenticate as another user when logging in as a user with SSO enabled, and any user account without a second factor enabled could be compromised.
Discourse is an open source discussion platform with a vulnerability that can cause a denial of service when attempting to create or update a custom sidebar section. This issue has been patched in commit `52b003d915`.
An Improper Validation of Specified Index, Position, or Offset in Input vulnerability in the Connectivity Fault Management (CFM) module of Juniper Networks Junos OS allows an adjacent attacker on the local broadcast domain to cause a Denial of Service (DoS) by sending malformed CFM packets.
An out-of-bounds read flaw was found in w3m, in the growbuf_to_Str function in indep.c. This issue may allow an attacker to cause a denial of service through a crafted HTML file.
An out-of-bounds read flaw was found in w3m, in the Strnew_size function in Str.c. This issue may allow an attacker to cause a denial of service through a crafted HTML file.
An issue in Archer Platform before v.6.13 fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to obtain sensitive information via the log files.