CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A stored cross site scripting (XSS) vulnerability in Issabel PBX version 4 in index.php?menu=billing_rates allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Name or Prefix fields under the Create New Rate module.
A stored cross-site scripting (XSS) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Group and Description parameters.
A critical vulnerability was found in Ruijie BCR810W version 2.5.10, affecting some unknown processing of the Tracert Page component. Manipulation leads to os command injection.
A critical vulnerability was found in kodbox 1.26 affecting the Execute function of the webconsole.php.txt file in the WebConsole Plug-In component. Manipulation of this function leads to OS command injection.
A critical vulnerability was found in TamronOS up to version 20230703, affecting an unknown part of the file /api/ping. Manipulation of the host argument leads to OS command injection.
A critical vulnerability was found in PHPGurukul Online Shopping Portal 1.0 in an unknown functionality of the Registration Page. Manipulation of this vulnerability leads to improper restriction of excessive authentication attempts.
An attacker could bypass the latest Delta Electronics InfraSuite Device Master patch (versions prior to 1.0.7), allowing access to file contents.
A critical vulnerability was found in the Best Fee Management System version 1.0. The issue affects the save_user function in the admin_class.php file of the Add User Handler component, leading to improper access controls.
The PHPGurukul Online Fire Reporting System version 1.2 has a Cross Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload injected into the search field.
The Hostel Management System v2.1 has a Cross-Site Scripting (XSS) vulnerability that allows an attacker to execute arbitrary code via a crafted payload in the search booking field.
The PHPGurukul Online Security Guards Hiring System version 1.0 has a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload in the search booking box.
The Hostel Management System v2.1 has a Cross Site Scripting vulnerability that allows an attacker to execute arbitrary code via crafted input in the Guardian name, Guardian relation, complimentary address, city, permanent address, and city fields on the Book Hostel & Room Details page.
Improper handling of additional special elements in GitHub repository squidex/squidex prior to version 7.4.0.
A vulnerability has been identified in version 7.11.8 of HadSky in an unknown functionality of the User Handler component, leading to cross-site request forgery (CSRF). The attack can be launched remotely.
A critical vulnerability was found in DedeCMS version 5.7.109, affecting an unknown functionality of the file co_do.php. Manipulation of the argument rssurl leads to server-side request forgery.
Improper authorization exists in the GitHub repository pimcore/customer-data-framework prior to version 3.4.1.
An Open Redirect vulnerability exists in the GitHub repository alextselegidis/easyappointments prior to version 1.5.0.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository nilsteampassnet/teampass prior to version 3.0.10. An attacker can exploit this vulnerability to inject malicious scripts in the user's context.
The Float menu WordPress plugin before 5.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
The EventON WordPress plugin before version 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event. This allows unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.