CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.05)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In the fastDial service, there is a missing permission check, which could lead to local information disclosure with no additional execution privileges needed.
In the fastDial service, there is a missing permission check, which could lead to local information disclosure without the need for additional execution privileges.
In the telephony service, there is a missing permission check, which could lead to local information disclosure without the need for additional execution privileges.
In the telephony service, there is a missing permission check, which could lead to local information disclosure with no additional execution privileges needed.
In the telephony service, there is a missing permission check, which could lead to local information disclosure without the need for additional execution privileges.
In the telephony service, there is a missing permission check, which could lead to local information disclosure with no additional execution privileges needed.
In the telephony service, there is a missing permission check, which could lead to local information disclosure without the need for additional execution privileges.
In telephony service, there is a missing permission check, which could lead to local information disclosure with no additional execution privileges needed.
In the telephony service, there is a missing permission check, which could lead to local information disclosure without the need for additional execution privileges.
In the telephony service, there is a missing permission check, which could lead to local information disclosure with no additional execution privileges needed.
In the telephony service, there is a missing permission check, which could lead to local information disclosure without the need for additional execution privileges.
In the telephony service, there is a missing permission check, which could lead to local information disclosure without the need for additional execution privileges.
In the telephony service, there is a missing permission check, which could lead to local information disclosure without the need for additional execution privileges.
A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause loss of confidentiality when replacing a project file on the local filesystem and after manual restart of the server.
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE tampers with backups which are then manually restored.
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE uploads or tampers with install packages.
The About Me 3000 widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via admin settings in versions up to and including 2.2.6 due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_firebase_server_key function. This allows unauthenticated attackers to update the Firebase server key for push notifications when the order status changes, provided they can trick a site administrator into performing an action such as clicking on a link.
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_status_order_title function. This allows unauthenticated attackers to update status order titles via a forged request if they can trick a site administrator into performing an action such as clicking on a link.
The ARMember plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 4.0.5. This is due to missing or incorrect nonce validation on the arm_check_user_cap function, allowing unauthenticated attackers to perform multiple unauthorized actions via a forged request.