CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.05)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A critical vulnerability has been found in SourceCodester AC Repair and Services System version 1.0, affecting unknown processing of the file Master.php?f=save_book in the HTTP POST Request Handler component. Manipulation of the argument id leads to SQL injection.
CVE-2023-3319 describes an improper neutralization of input during web page generation in iDisplay PlatPlay DS, leading to Stored XSS vulnerabilities. This issue affects PlatPlay DS versions before 3.14.
An issue has been discovered in GitLab CE/EE that allows an attacker to merge arbitrary code into protected branches. This affects all versions starting from 15.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, and all versions starting from 16.1 before 16.1.1.
An information disclosure issue in GitLab CE/EE affects all versions from 16.0 prior to 16.0.6, and version 16.1.0. It allows unauthenticated actors to access the import error information if a project was imported from GitHub.
ELECOM wireless LAN routers are vulnerable to sensitive information exposure, allowing a network-adjacent unauthorized attacker to obtain sensitive information.
Path Traversal vulnerability in SonicWall GMS and Analytics allows a remote authenticated attacker to read arbitrary files from the underlying file system via web service. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
CVE-2023-34134 describes a vulnerability that exposes sensitive information, allowing an authenticated attacker to read the administrator password hash via a web service call in SonicWall GMS and Analytics. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
A vulnerability in SonicWall GMS and Analytics allows an unauthorized attacker to access restricted web pages. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
An open redirect vulnerability in ELECOM wireless LAN routers and repeaters allows a remote unauthenticated attacker to redirect users to arbitrary websites. The attacker can use a specially crafted URL to conduct phishing attacks.
CVE-2023-37560 describes a cross-site scripting vulnerability in WRH-300WH-H v2.12 and earlier, and WTC-300HWH v1.09 and earlier, allowing a remote unauthenticated attacker to inject arbitrary scripts.
Path Traversal vulnerability in GMS and Analytics allows an authenticated attacker to read arbitrary files from the underlying filesystem with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
In the incfs_kill_sb function in fs/incfs/vfs.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege requiring System execution privileges.
GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive.
A critical vulnerability was found in SourceCodester Service Provider Management System version 1.0. Manipulation of the 'id' argument in the file /classes/Master.php?f=save_inquiry leads to SQL injection, which can be initiated remotely.
A vulnerability was found in GZ Scripts Vacation Rental Website 1.8, affecting some unknown functionality of the file /VacationRentalWebsite/property/8/ad-has-principes/ in the HTTP POST Request Handler component. Manipulation of the arguments username/title/comment leads to cross-site scripting.
A vulnerability has been found in NodCMS 3.4.1 affecting an unknown functionality of the file /en/blog-comment-4 in the POST Request Handler component. Manipulation of the arguments comment_name/comment_content leads to cross site scripting.
A vulnerability exists in Palo Alto Networks PAN-OS software that allows an authenticated administrator with the privilege to commit a specifically created configuration to read local files and resources from the system.
Online Piggery Management System version 1.0 is vulnerable to Cross Site Scripting (XSS). An unauthenticated user can POST JavaScript code to 'manage-breed.php', resulting in Persistent XSS.
A missing permission check in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, `.csv`, and `.ycsb` files on the Jenkins controller file system.
The MathWorks Polyspace Plugin for Jenkins version 1.0.5 and earlier allows attackers with Item/Configure permission to send emails with arbitrary files from the Jenkins controller file systems.