CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Uptime Kuma, a monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1. This allows authenticated users to delete files from the server, potentially leading to data loss and system unavailability.
1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker could craft malicious payloads to achieve command injection when entering the container terminal.
1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious payload to achieve command injection when adding container repositories.
Pandoc, a Haskell library for converting markup formats, has an arbitrary file write vulnerability that can be triggered by a specially crafted image element in the input. This affects versions from 1.13 to 3.1.4 when generating files using the `--extract-media` option or outputting to PDF format.
Taocms versions up to 3.0.2 are vulnerable to Cross Site Scripting (XSS), allowing attackers to inject malicious code into the application.
MechanicalSoup is a Python library for automating interaction with websites. In versions from 0.2.0 to prior to 1.3.0, a malicious web server can read arbitrary files on the client using an `<input type="file" ...>` inside an HTML form.
GLPI is a free asset and IT management software package. In versions from 9.4.0 to prior to 10.0.8, a malicious link can be crafted by an unauthenticated user, leading to a reflected XSS vulnerability if any authenticated user opens the crafted link.
GLPI is a free asset and IT management software package. Versions from 9.2.0 to prior to 10.0.8 have an incorrect rights check on a file accessible by an authenticated user, allowing access to view all KnowbaseItems.
AMI SPx contains a vulnerability in the BMC where a valid user may cause a use of hard-coded credentials. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability.
AMI SPx contains a vulnerability in the BMC where an attacker may cause an improper neutralization of CRLF sequences in HTTP headers. A successful exploit of this vulnerability may lead to a loss of integrity.
AMI SPx contains a vulnerability in the BMC where a user may cause a missing cryptographic step by generating a hash-based message authentication code (HMAC). A successful exploit of this vulnerability may lead to the loss of confidentiality, integrity, and authentication.
In MADEFORNET HTTP Debugger through 9.12, the Windows service does not set the seclevel registry key before launching the driver. Thus, it is possible for an unprivileged application to obtain a handle to the NetFilterSDK wrapper before the service obtains exclusive access.
GLPI is a free asset and IT management software package. Versions from 0.68 to prior to 10.0.8 have an incorrect rights check on a file accessible by an authenticated user, allowing access to the list of all users and their personal information.
CVE-2023-33335 describes a Cross Site Scripting (XSS) vulnerability in Sophos iView software, allowing arbitrary script execution in the grpname parameter. This software reached its end of life on December 31, 2020.
An Open Redirect vulnerability exists in the GitHub repository go-gitea/gitea prior to version 1.19.4.
There is an unauthenticated buffer overflow vulnerability in the process controlling the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in a Denial-of-Service (DoS) condition affecting the web-based management interface of the controller.
A vulnerability in ArubaOS allows an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
Vulnerabilities exist which allow an authenticated attacker to access sensitive information on the ArubaOS command line interface. Successful exploitation could allow access to data beyond what is authorized by the user's existing privilege level.
Vulnerabilities exist that allow an authenticated attacker to access sensitive information on the ArubaOS command line interface. Successful exploitation could allow access to data beyond what is authorized by the user's existing privilege level.
An authenticated path traversal vulnerability exists in ArubaOS. Successful exploitation allows for the deletion of arbitrary files in the underlying operating system.