CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Chamilo versions 1.11.x up to 1.11.20 allow users with admin privileges to insert XSS in the extra fields management section.
Chamilo versions 1.11.x up to 1.11.20 allow users with admin privileges to insert XSS in the careers and promotions management section.
Chamilo versions 1.11.x up to 1.11.20 allow users with admin privilege accounts to insert XSS in the course categories' definition.
Chamilo versions 1.11.x up to 1.11.20 allow users with admin privilege accounts to insert XSS in the languages management section.
Zoho ManageEngine ADAudit Plus before version 7100 allows XSS via the username field.
The Release module in Zoho ManageEngine ServiceDesk Plus before version 14202, ServiceDesk Plus MSP before version 14300, and SupportCenter Plus before version 14300 has a privilege escalation vulnerability that allows unprivileged users to access the Reminders of a release ticket and make modifications.
A critical vulnerability was found in SourceCodester Shopping Website 1.0, affecting an unknown function in the check_availability.php file. Manipulation of the email argument leads to SQL injection.
A vulnerability in Apache Johnzon related to the deserialization of untrusted data allows an attacker to input large numbers in JSON format, potentially leading to slow conversion and Denial of Service risk.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository outline/outline prior to version 0.70.1, allowing for the storage of malicious code.
IBM WebSphere Application Server versions 8.5 and 9.0 may provide weaker than expected security due to improper encoding in a local configuration file.
PiiGAB M-Bus stores credentials in a plaintext file, which could allow a low-level user to gain admin credentials.
In Sentry versions 23.6.0 to 23.6.2, the Sentry API incorrectly returns the `access-control-allow-credentials: true` HTTP header when the `Origin` request header ends with the `system.base-hostname` option. This issue only affects installations where this option is explicitly set.
The number of login attempts is not limited, which could allow an attacker to perform a brute force attack on HTTP basic authentication.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository nilsteampassnet/teampass prior to version 3.0.10, allowing for the storage of malicious code.
Mastodon, a social network server based on ActivityPub, has a vulnerability that allows an attacker to craft a verified profile link that misleads users about the actual URL. Versions from 2.6.0 to prior to 3.5.9, 4.0.5, and 4.1.3 are affected.
A vulnerability in yt-dlp allows for cookie leakage during file downloads, potentially leading to unauthorized access to data. The issue affects versions prior to 2023.07.06 and nightly builds before 2023.07.06.185519, except for `curl` and `httpie` version 3.1.0 or later.
A vulnerability has been found in Rotem Dynamics Rotem CRM up to version 20230729, allowing remote information exposure through manipulation of the OTP URI Interface. The issue affects an unknown part of the file /LandingPages/api/otp/send?id=[ID][ampersand]method=sms.
A critical vulnerability was found in ThinuTech ThinuCMS version 1.5. Manipulation of the cat_id argument in the /category.php file leads to SQL injection, which can be exploited remotely.
An issue was discovered in the Linux kernel through 6.4.2 related to the UDF filesystem, leading to a use-after-free write operation in the udf_put_super and udf_close_lvid functions.
An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2, leading to an out-of-bounds error and crash in read_descriptors in drivers/usb/core/sysfs.c.