CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Reflected XSS vulnerability affects the 'mode' parameter in the /admin functionality of the web application in versions <=2.0.44.
The Subscribe2 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 10.40. This is due to missing or incorrect nonce validation when sending test emails.
The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 8.4.6. This is due to missing or incorrect nonce validation on the 'save_customer' function, allowing unauthenticated attackers to change the admin role to customer or modify user meta via a forged request.
A vulnerability in NEC Aterm devices allows an attacker to execute arbitrary scripts after obtaining high privileges by exploiting the previous vulnerabilities CVE-2023-3330 and CVE-2023-3331.
The CVE-2023-3331 vulnerability in NEC Corporation Aterm products has an improper limitation of a pathname to a restricted directory, allowing an attacker to delete specific files in the product.
CVE-2023-3330 describes an improper limitation of a pathname to a restricted directory vulnerability in NEC Corporation products, allowing an attacker to access specific files on the device.
The pypdf library, an open-source pure-Python library, has a vulnerability that can lead to an infinite loop when processing a malicious PDF file. This issue occurs in versions where the `__parse_content_stream` method is executed.
Meldekarten generator is an open source project that allows creating, storing, and printing registration cards for volunteers. All text fields on the webpage are vulnerable to XSS attacks as user input isn't (fully) sanitized after submission.
A CSRF vulnerability in Issabel issabel-pbx v.4.0.0-6 allows a remote attacker to gain privileges via a Custom CSRF exploit to create new user function in the application.
A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary code via a crafted script to the Description parameter.
A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary code via a vulnerable parameter GrpPath.
A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary code via a crafted script to the Dtltyp and ListName parameters.
A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary JavaScript code via a vulnerable delete_file parameter.
Stormshield Endpoint Security Evolution versions 2.0.0 through 2.4.2 has insecure permissions. An ACL entry on the SES Evolution agent directory containing the agent logs displayed in the GUI allows interactive users to read data, which could allow access to information reserved for administrators.
Stormshield Endpoint Security Evolution versions 2.0.0 through 2.3.2 have insecure permissions. An interactive user can use the SES Evolution agent to create arbitrary files with local system privileges.
i-doit Open v24 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the timeout parameter on the login page.
Cloudexplorer-lite is an open source cloud software stack that did not enforce strong passwords in versions prior to 1.2.0. Weak passwords can be easily guessed, making the system vulnerable to brute force attacks.
Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, allowing the construction of different email addresses that ultimately resulted in the same address shared by multiple accounts.
Shopware is an open source e-commerce software. Due to an incorrect configuration in the `.htaccess` file, the configuration file of the Javascript (`themes/package-lock.json`) could be read in production environments, allowing attackers to determine the specific Shopware version in a deployment.
Improper access control exists in the GitHub repository plantuml/plantuml prior to version 1.2023.9.