CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In telephony service, there is a missing permission check, which could lead to local information disclosure with no additional execution privileges needed.
In the telephony service, there is a missing permission check, which could lead to local information disclosure without the need for additional execution privileges.
In the telephony service, there is a missing permission check, which could lead to local information disclosure with no additional execution privileges needed.
In the telephony service, there is a missing permission check, which could lead to local information disclosure without the need for additional execution privileges.
In the telephony service, there is a missing permission check, which could lead to local information disclosure without the need for additional execution privileges.
In the telephony service, there is a missing permission check, which could lead to local information disclosure without the need for additional execution privileges.
A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause loss of confidentiality when replacing a project file on the local filesystem and after manual restart of the server.
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE tampers with backups which are then manually restored.
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE uploads or tampers with install packages.
The About Me 3000 widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via admin settings in versions up to and including 2.2.6 due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_firebase_server_key function. This allows unauthenticated attackers to update the Firebase server key for push notifications when the order status changes, provided they can trick a site administrator into performing an action such as clicking on a link.
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_status_order_title function. This allows unauthenticated attackers to update status order titles via a forged request if they can trick a site administrator into performing an action such as clicking on a link.
The ARMember plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 4.0.5. This is due to missing or incorrect nonce validation on the arm_check_user_cap function, allowing unauthenticated attackers to perform multiple unauthorized actions via a forged request.
GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the BM_ParseIndexValueReplace function at /lib/libgpac.so.
GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the gf_isom_remove_user_data function at /lib/libgpac.so.
GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the gf_dump_vrml_sffield function at /lib/libgpac.so.
GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the dump_isom_scene function at /mp4box/filedump.c.
Pimcore Admin Classic Bundle, based on the ExtJS framework, has a vulnerability that allows an administrator who has not set up two-factor authentication to execute arbitrary scripts/HTML content. The attack does not require any privileges.
A critical vulnerability has been identified in the Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System. The issue affects unknown processing of the file /Duty/AjaxHandle/UpLoadFloodPlanFile.ashx, leading to unrestricted file uploads.
A critical vulnerability was found in the Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System, allowing unrestricted file uploads. The issue affects unknown code in the file /Duty/AjaxHandle/Write/UploadFile.ashx, where manipulation of the argument Filedata enables remote attacks.