CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A critical vulnerability was found in IBOS OA 4.5.5 in the createDeleteCommand function of the file ?r=article/default/delete of the Delete Packet component. Manipulation of this function leads to SQL injection, allowing for remote attacks.
A critical vulnerability was found in SourceCodester AC Repair and Services System version 1.0. The issue affects unknown processing of the file Master.php?f=save_service in the HTTP POST Request Handler component, leading to SQL injection.
A flaw was found in the skcipher_recvmsg function in the Linux kernel’s interface for symmetric key cipher algorithms. This flaw allows a local user to crash the system.
A Cross-site Scripting (XSS) vulnerability, stored in the GitHub repository amauric/tarteaucitron.js prior to version 1.13.1. An attacker can exploit this vulnerability to inject malicious scripts that will be executed in the victim's browser context.
Version 2.15.0 of fast-poster is vulnerable to Cross Site Scripting (XSS). The file upload check only verifies binary image data but does not strictly check the file suffix, leading to stored XSS.
TwoNav version 2.0.28-20230624 is vulnerable to Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious scripts in the user's browser context.
Cross Site Scripting vulnerability in IP-DOT BuildaGate v.BuildaGate5 allows a remote attacker to execute arbitrary code via a crafted script to the mc parameter of the URL.
A buffer overflow vulnerability in the aswSnx.sys driver of Avast AntiVirus before version 19.7 allows a local attacker to cause a denial of service (DoS) via a crafted request.
The WePupil Quiz Expert plugin versions up to 1.5.0 contain a Cross-Site Request Forgery (CSRF) vulnerability. This allows attackers to send unauthorized requests on behalf of users.
CSRF vulnerability in ChubbyNinjaa Template Debugger plugin versions <= 3.1.2 allows unauthorized actions on behalf of the user.
The StoreApps Stock Manager plugin for WooCommerce versions <= 2.10.0 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.
The Securimage-WP plugin versions up to 3.6.16 contain a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of a logged-in user.
CSRF vulnerability in the Prem Tiwari Disable WordPress Update Notifications and auto-update Email Notifications plugin in versions <= 2.3.3 allows attackers to perform unauthorized actions on behalf of the user.
Cross-Site Request Forgery (CSRF) vulnerability exists in Andy Whalen's Galleria plugin versions <= 1.0.3. This allows attackers to send unauthorized requests on behalf of users.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Recent Posts Slider plugin by Neha Goel in versions <= 1.1. This allows attackers to send unauthorized requests on behalf of users.
The AREOI All Bootstrap Blocks plugin versions up to 1.3.6 contain a Cross-Site Request Forgery (CSRF) vulnerability. This may allow attackers to perform unauthorized actions on behalf of an authenticated user.
The NextGen GalleryView plugin for WordPress versions <= 0.5.5 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of a logged-in user.
CSRF vulnerability in Andrea Tarantini's Menubar plugin versions <= 5.8.2 allows attackers to perform unauthorized actions on behalf of users.
CSRF vulnerability in WPMobilePack.Com WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps, present in versions <= 3.4.1.
A vulnerability has been identified in RUGGEDCOM ROX MX5000, ROX MX5000RE, ROX RX1400, ROX RX1500, ROX RX1501, ROX RX1510, ROX RX1511, ROX RX1512, ROX RX1524, ROX RX1536, and ROX RX5000 in versions below V2.16.0. The affected devices are configured to offer weak ciphers by default, which could allow an unauthorized attacker in a man-in-the-middle position to read and modify any data passed over to and from the affected device.