CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The WP Abstracts plugin by Kevon Adonis in versions up to 2.6.2 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of a logged-in user.
The OOPSpam Anti-Spam plugin versions up to 1.1.44 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.
The LWS Tools plugin versions up to 2.4.1 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.
The Conditional shipping & Advanced Flat rate shipping rates / Flexible shipping plugin for WooCommerce has a Cross-Site Request Forgery (CSRF) vulnerability in versions up to 1.6.4.4. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.
The LWS Cleaner plugin versions <= 2.3.0 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.
In SAP ERP Defense Forces and Public Security systems in versions 600, 603, 604, 605, 616, 617, 618, 802, 803, 804, 805, 806, 807, an authenticated attacker with admin privileges can write arbitrary data to the syslog file. This allows modification of all syslog data, leading to a complete compromise of the application's integrity.
In SAP Enable Now versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, and ENABLE_NOW_CONSUMP_DEL 1704, the Referrer-Policy response header is not implemented, allowing an unauthenticated attacker to obtain referrer details, resulting in information disclosure.
In SAP Enable Now versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, and ENABLE_NOW_CONSUMP_DEL 1704, the X-Content-Type-Options response header is not implemented. This allows an unauthenticated attacker to trigger MIME type sniffing, leading to Cross-Site Scripting.
SAP BusinessObjects Business Intelligence Platform versions 420 and 430 allow an unauthorized attacker who hijacked a user session to bypass the victim's old password via brute force due to unrestricted rate limit for password change functionality.
SAP NetWeaver Application Server ABAP and ABAP Platform in versions KRNL64NUC, 7.22 and KERNEL 7.22-7.93 perform improper authentication checks for functionalities requiring user identity. As a result, an attacker can perform malicious actions over the network.
The Runtime Workbench (RWB) of SAP NetWeaver Process Integration - version SAP_XITOOL 7.50 does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product status and its configuration.
The Message Display Tool (MDT) of SAP NetWeaver Process Integration - version SAP_XIAF 7.50 does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product status and its configuration.
When creating a journal entry template in SAP S/4HANA, an attacker could intercept the save request and change the template, impacting the confidentiality and integrity of the resource. Additionally, a standard template could be deleted, leading to temporary unavailability of the resource.
The BICS communication layer in SAP BW and SAP BW/4HANA may expose unauthorized cell values in the response to queries. However, appropriate authorization is still required at the query and key figure level.
In SAP Enable Now versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, and ENABLE_NOW_CONSUMP_DEL 1704, the Content-Security-Policy and X-XSS-Protection response headers are missing. This allows an unauthenticated attacker to attempt reflected cross-site scripting, which could lead to disclosure or modification of information.
A stored cross-site scripting (XSS) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Virtual Fax Name and Caller ID Name parameters under the New Virtual Fax feature.
A stored cross site scripting (XSS) vulnerability in Issabel PBX version 4 in index.php?menu=billing_rates allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Name or Prefix fields under the Create New Rate module.
A stored cross-site scripting (XSS) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Group and Description parameters.
A critical vulnerability was found in Ruijie BCR810W version 2.5.10, affecting some unknown processing of the Tracert Page component. Manipulation leads to os command injection.
A critical vulnerability was found in kodbox 1.26 affecting the Execute function of the webconsole.php.txt file in the WebConsole Plug-In component. Manipulation of this function leads to OS command injection.