CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQLFluff, a SQL linter, prior to version 2.1.2 had a vulnerability that allowed untrusted users to execute arbitrary Python code by modifying the `library_path` value in configuration files. Version 2.1.2 introduces the ability to overwrite this value from the command line, mitigating the risk.
A stored cross-site scripting (XSS) vulnerability in the Basic Website Information module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
A stored cross-site scripting (XSS) vulnerability in the Image Upload module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
A stored cross-site scripting (XSS) vulnerability in the Basic Information module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
A stored cross-site scripting (XSS) vulnerability in the Column management module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
A stored cross-site scripting (XSS) vulnerability in the custom variables module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
YznCMS v1.1.0 has a Cross-Site Request Forgery (CSRF) vulnerability in the /public/admin/profile/update.html component, allowing attackers to arbitrarily change the Administrator password via a crafted POST request.
A stored cross-site scripting (XSS) vulnerability in the Management Custom label module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
A stored cross-site scripting (XSS) vulnerability in the Site Setup module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Bagecms v3.1.0 has a stored XSS vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Settings module.
A XSS vulnerability in CMS Made Simple v2.2.17 allows remote attackers to inject arbitrary web scripts or HTML via the File Upload function.
Novu has an open redirect vulnerability in the 'Sign In with GitHub' functionality in versions prior to 0.16.0. An attacker could force a victim to open a malicious URL, potentially logging into the repository under the victim's account.
TravianZ through version 8.3.4 allows XSS via the Alliance tag/name, the statistics page, the link preferences, the Admin Logs, or the COOKUSR cookie.
Metersphere is an open source continuous testing platform. In versions prior to 2.10.2 LTS, some key APIs in Metersphere lack permission checks, allowing ordinary users to execute operations reserved for space or project administrators.
Vulnerability in the hang detector module related to kernel raw address leakage. Successful exploitation of this vulnerability may affect service confidentiality.
Vulnerability related to incomplete verification of apps' permissions to access a certain API in the wireless projection module. Successful exploitation of this vulnerability may affect some wireless projection features.
A Cross-site Scripting (XSS) vulnerability is reflected in the GitHub repository fossbilling/fossbilling prior to version 0.5.4.
In the GitHub repository it-novum/openitcockpit prior to version 4.6.6, there is a vulnerability related to sensitive cookies in HTTPS sessions that lack the 'Secure' attribute.
Statamic is a flat-first content management system powered by Laravel and Git. In versions prior to 4.10.0, the SVG tag does not sanitize malicious SVG, allowing attackers to perform cross-site scripting attacks using SVG, even when using the `sanitize` function. Version 4.10.0 contains a patch for this issue.
Uptime Kuma, a monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1. This allows authenticated users to delete files from the server, potentially leading to data loss and system unavailability.