CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.05)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2023-37598 in issabel-pbx version 4.0.0-6 has a Cross Site Request Forgery (CSRF) vulnerability that allows a remote attacker to cause a denial of service via the delete new virtual fax function.
The Feedbacksystem stores passwords of users using LDAP login in clear text in the database. This issue occurs during the first login when the password is transmitted unencrypted.
Discourse, an open source discussion platform, has a nonce reuse vulnerability in its Content Security Policy (CSP) that could allow XSS attacks to bypass CSP protection. Currently, there are no known XSS vectors, but if one is discovered, this vulnerability would allow XSS attacks to completely bypass CSP.
cmark-gfm is an extended version of the C reference implementation of CommonMark, which has three polynomial time complexity issues. These issues may lead to unbounded resource exhaustion and subsequent denial of service.
Multiple cross-site scripting (XSS) vulnerabilities in Geeklog v2.2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Rule and Route parameters of /admin/router.php.
Multiple cross-site scripting (XSS) vulnerabilities in Geeklog v2.2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Mail Settings[backend], Mail Settings[host], Mail Settings[port], and Mail Settings[auth] parameters of the /admin/configuration.php.
In ImpressCMS versions v1.4.5 and earlier, there is a cross-site scripting (XSS) vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the smile_code parameter of the /editprofile.php component.
A cross-site scripting (XSS) vulnerability in Maid Hiring Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter of the /admin/contactus.php component.
An issue exists in YSoft SAFEQ 6 Server before version 6.0.82 related to modifying the LDAP server configuration URL. Changing from LDAPS to LDAP does not require re-entering the password, leading to the exposure of cleartext credentials.
A cross-site scripting (XSS) vulnerability in Maid Hiring Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page Description of the /admin/aboutus.php component.
A cross-site scripting (XSS) vulnerability was discovered in Maid Hiring Management System v1.0 via the component /admin/search-booking-request.php.
A cross-site scripting (XSS) vulnerability in Teacher Subject Allocation System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search text box.
Incorrect signature verification of the firmware during the Device Firmware Update process of Belkin Wemo Smart Plug WSP080 v1.2 allows attackers to cause a Denial of Service (DoS) via a crafted firmware file.
A critical vulnerability was found in AC Repair and Services System version 1.0. Manipulation of the 'id' argument in the file /classes/Master.php?f=save_inquiry leads to SQL injection.
A critical vulnerability was found in AC Repair and Services System version 1.0, affecting an unknown function of the file Master.php?f=delete_book. Manipulation of the argument id leads to SQL injection.
A critical vulnerability has been found in SourceCodester AC Repair and Services System version 1.0, affecting unknown processing of the file Master.php?f=save_book in the HTTP POST Request Handler component. Manipulation of the argument id leads to SQL injection.
CVE-2023-3319 describes an improper neutralization of input during web page generation in iDisplay PlatPlay DS, leading to Stored XSS vulnerabilities. This issue affects PlatPlay DS versions before 3.14.
An issue has been discovered in GitLab CE/EE that allows an attacker to merge arbitrary code into protected branches. This affects all versions starting from 15.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, and all versions starting from 16.1 before 16.1.1.
An information disclosure issue in GitLab CE/EE affects all versions from 16.0 prior to 16.0.6, and version 16.1.0. It allows unauthenticated actors to access the import error information if a project was imported from GitHub.
ELECOM wireless LAN routers are vulnerable to sensitive information exposure, allowing a network-adjacent unauthorized attacker to obtain sensitive information.