CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Joplin before 2.11.5 allows XSS via an AREA element of an image map.
Joplin versions before 2.11.5 allow XSS via a USE element in an SVG document.
The web interface of Gira KNX/IP-Router 3.1.3683.0 and 3.3.8.0 is vulnerable to reflective XSS attacks. It responds with a '404 - Not Found' status code for non-existent paths, but the value of the path is reflected in the response.
A critical vulnerability was found in IBOS OA version 4.5.5, affecting the actionEdit function of the file ?r=dashboard/roleadmin/edit&op=member of the Add User Handler component. Manipulation of the argument id leads to SQL injection.
A Cross-site Scripting (XSS) vulnerability is reflected in the GitHub repository hestiacp/hestiacp prior to version 1.7.8. An attacker could exploit this flaw to inject malicious scripts.
A critical vulnerability was found in Campcodes Retro Cellphone Online Store version 1.0, affecting an unknown function in the file /admin/edit_product.php. Manipulation of the argument username leads to SQL injection.
Some Zoom clients may expose information intended to be encrypted, potentially leading to the disclosure of sensitive data.
A reflected cross site scripting (XSS) vulnerability was discovered in Sophos Web Appliance v4.3.9.1 that allows for arbitrary code to be inputted via double quotes.
The thorsten/phpmyfaq GitHub repository prior to version 3.2.0-beta.2 is vulnerable to reflected Cross-site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious scripts that will be executed in users' browsers.
A stored Cross-Site Scripting (XSS) vulnerability was found in firmware version 2.2.6733 of the Multilaser RE 170 router. It allows an attacker to inject a malicious script that will execute in other users' browsers.
The affected TBox RTUs are missing authorization for running some API commands. An attacker could exploit these commands to reveal sensitive information such as software versions and web server file contents.
Tuleap has an issue with managing user permissions after changing project visibility. Restricted users who were project administrators before the visibility switch retain access to the project and can perform administrative actions.
ILIAS versions 7.21 and 8.0_beta1 through 8.2 are vulnerable to reflected Cross-Site Scripting (XSS).
ILIAS versions 7.21 and 8.0_beta1 through 8.2 are vulnerable to stored Cross Site Scripting (XSS).
Telegram v9.6.3 on iOS allows attackers to hide critical information on the User Interface via calling the function SFSafariViewController.
An issue was discovered in the Cargo extension for MediaWiki through version 1.39.3, allowing the storage of javascript: URLs in URL fields and automatically linking these URLs.
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In Special:CheckUser, a check of the 'get edits' type is vulnerable to HTML injection through the User-Agent HTTP request header.
An issue was discovered in the Cargo extension for MediaWiki through 1.39.3 related to XSS. This can occur in Special:CargoQuery via a crafted page item when using the default format.
An issue was discovered in the GoogleAnalyticsMetrics extension for MediaWiki through 1.39.3, where the googleanalyticstrackurl parser function does not properly escape JavaScript in the onclick handler and does not prevent the use of javascript: URLs.
Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code.