CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In Firefox, when configured to block the storage of all cookies, it was still possible to store data in localstorage using an iframe with a source of 'about:blank'. This could lead to malicious websites storing tracking data without user consent.
The TN-5900 Series version 3.3 and prior is vulnerable to a user enumeration vulnerability. This vulnerability may allow a remote attacker to determine if a user is valid during password recovery through the web login page.
A website could prevent a user from exiting full-screen mode via alert and prompt calls. This could lead to user confusion and possible spoofing attacks. This vulnerability affects Firefox versions below 115.
The vulnerability allows an attacker to trick a user into submitting sensitive data to a malicious website by uploading files that contain symlinks. This affects Firefox versions below 115.
The use of RTL Arabic characters in the address bar may have allowed for URL spoofing. This vulnerability affects Firefox versions below 115.
A vulnerability in Firefox (< 115) allows a website to obscure the fullscreen notification by using an option element, potentially causing delays due to an expensive computational function. This could lead to user confusion and possible spoofing attacks.
The vulnerability allowed a website to obscure the fullscreen notification by using a URL handled by an external program, which could lead to user confusion and potential spoofing attacks.
The use of TikaEncodingDetector in Apache Any23 can lead to excessive memory usage.
Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files.
Bouncy Castle for Java before version 1.74 is affected by an LDAP injection vulnerability. This vulnerability affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates, where the certificate's Subject Name is inserted into an LDAP search filter without proper escaping.
A critical vulnerability was found in SmartWeb Infotech Job Board version 1.0, affecting some unknown functionality of the file /settings/account in the My Profile Page component. Manipulation of the argument filename leads to unrestricted file uploads.
A critical vulnerability has been found in SourceCodester Shopping Website 1.0, related to an unknown functionality of the file insert-product.php. Manipulation of this functionality leads to unrestricted file uploads.
A critical vulnerability was found in SourceCodester Shopping Website version 1.0, affecting an unknown function in the file search-result.php. Manipulation of the argument 'product' leads to SQL injection.
The Protect WP Admin WordPress plugin before 4.0 discloses the URL of the admin panel via a redirection of a crafted URL, bypassing the protection offered.
All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files could open a file to load the document into memory, including sensitive information associated with the document, such as the password.
Affected TBox RTUs allow low privilege users to access software security tokens of higher privilege. An attacker with 'user' privileges could access files requiring higher privileges by establishing an SSH session and providing the other tokens.
Affected TBox RTUs generate software security tokens using insufficient entropy. The random seed used to generate the software tokens is not initialized correctly, and other parts of the token are generated using predictable time-based values.
Maxsite CMS version 108.7 has a Cross Site Scripting vulnerability that allows a remote attacker to execute arbitrary code via the f_content parameter in the admin/page_new file.
A Cross-Site Scripting vulnerability in bbs-go version 3.5.5 and earlier allows a remote attacker to execute arbitrary JavaScript code via a crafted payload in the 'announcements' parameter of the settings function.
Cross Site Scripting (XSS) vulnerability in bbs-go version 3.5.5 and earlier. A remote attacker can execute arbitrary code via a crafted payload in the comment parameter of the article function.