CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A ReDoS issue was discovered in the URI component before version 0.12.2 for Ruby. The URI parser mishandles invalid URLs with specific characters, leading to increased execution time when parsing strings to URI objects.
MCL-Net version 4.3.5.8788 has a Directory Browsing vulnerability that allows attackers to gain sensitive information about the configured databases via the '/file' endpoint.
The 'Submission Web Form' of the Turnitin LTI tool/plugin version 1.3 is affected by HTML Injection attacks. The security issue affects the submission web form where students submit their reports for similarity/plagiarism checks.
Annet AC Centralized Management Platform version 1.02.040 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject malicious code that will be stored and executed in users' browsers.
A Cross Site Scripting vulnerability in PHPgurukl User Registration Login and User Management System with admin panel v.1.0 allows a local attacker to execute arbitrary code via a crafted script to the signup.php.
In Veritas NetBackup Appliance before version 4.1.0.1 MR3, insecure permissions may allow an authenticated Admin to bypass shell restrictions and execute arbitrary operating system commands via SSH.
Multiple cross-site scripting (XSS) vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parameters.
An issue was discovered in the Linux kernel brcm_nvram_parse in drivers/nvmem/brcm_nvram.c. Lacks for the check of the return value of kzalloc() can cause the NULL Pointer Dereference.
A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue could allow a local user to crash the system.
A NULL pointer dereference flaw was found in the Linux kernel AMD Sensor Fusion Hub driver. This flaw allows a local user to crash the system.
PHPgurukl Hostel Management System v.1.0 is vulnerable to Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
A flaw was found in the MCTP protocol in the Linux kernel that may lead to use-after-free vulnerabilities. The mctp_unregister() function reclaims the device's resources when a netcard detaches, which can cause issues if a running routine is unaware of this.
A NULL pointer dereference flaw exists in the Linux kernel's submit_lookup_cmds function due to a lack of check on the return value of kmalloc(). This issue allows a local user to crash the system.
PHPgurukl Hostel Management System v.1.0 is vulnerable to Cross Site Scripting (XSS) via Add New Course.
PHPgurukl Hospital Management System v.1.0 is vulnerable to Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious scripts in the context of the victim's browser.
PHPgurukl Small CRM version 1.0 is vulnerable to Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code in the context of the user's browser.
An unauthenticated attacker within BLE proximity can remotely connect to a 7-Eleven LED Message Cup, Hello Cup 1.3.1 for Android, and bypass the application's client-side chat censor filter.
A critical vulnerability was found in the Ruijie RG-BCR860 device version 2.5.13, affecting unknown processing of the Network Diagnostic Page component. Manipulation leads to OS command injection.
A critical vulnerability has been found in IBOS OA 4.5.5 affecting the actionExport function of the file ?r=recruit/interview/export&interviews=x of the Interview Management Export component. Manipulation of the interviews argument leads to SQL injection.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository spinacms/spina prior to version 2.15.1, allowing for the storage of malicious code.