CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Nextcloud End-to-end encryption app provides the ability to implement end-to-end encryption on the client side. By providing an invalid metadata file, an attacker can make previously dropped files inaccessible.
NextCloud Server and NextCloud Enterprise Server provide file storage for a productivity platform. In versions 26.0.0 to 26.0.2, an attacker could supply a URL that redirects an unsuspecting user from a legitimate domain to an attacker's site.
The AWS Cloud Development Kit (AWS CDK) has a vulnerability related to overly permissive trust policies for the `CreationRole` and `default MastersRole` in versions `aws-cdk-lib` from 2.0.0 to 2.80.0 and `@aws-cdk/aws-eks` from 1.57.0 to 1.202.0.
Vega is a decentralized trading platform that prior to version 0.71.6 had a vulnerability allowing a malicious validator to trick the Vega network into re-processing past Ethereum events. This could lead to unauthorized increases in a user's account balance without additional deposits.
A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it has been freed and set to NULL.
Version 2.0 of POS Codekop was found to contain a reflected XSS vulnerability via the nm_member parameter in print.php.
In Progress WhatsUp Gold before version 23.0.0 has an SNMP-related application endpoint that fails to adequately sanitize malicious input. This could allow an unauthenticated attacker to execute arbitrary code in a victim's browser, known as XSS.
Remult is a CRUD framework for full-stack TypeScript. Using the apiPrefilter option in the @Entity decorator as a function intended to prevent unauthorized access to data may allow an attacker, knowing the id of an entity instance, to gain read, update, and delete access to it.
The 1.4.0 release of the Tauri framework introduced a regression in the filesystem scope check for dotfiles on Unix. Previously, dotfiles were not implicitly allowed by wildcard patterns, which changed due to the implementation of a configuration option.
There is a Session Fixation vulnerability in the GitHub repository fossbilling/fossbilling prior to version 0.5.1.
The Elenos ETG150 FM transmitter running version 3.12 was found leaking SMTP credentials and other sensitive information by exploiting the publicly accessible Memcached service. The attack can occur over the public Internet in some cases.
A critical vulnerability was found in SourceCodester Human Resource Management System version 1.0. Manipulation of the employeeid argument in the detailview.php file leads to SQL injection.
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter.
A vulnerability in FastAsyncWorldEdit (FAWE) allows an attacker to select a region using the `Infinity` keyword, enabling any operation to be executed. This could potentially bring the server down.
The XWiki Platform has a vulnerability that allows tags from pages not viewable to the current user to be leaked via the tags API. This information can be exploited to infer the document reference of non-viewable pages.
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie. This enables the attacker to impersonate that user via POST email_create and back parameter.
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via GET configure parameter.
Improper access control exists in the GitHub repository admidio/admidio prior to version 4.2.9.
The MagePeople Team Booking and Rental Manager for Bike plugin versions <= 1.2.1 has a stored Cross-Site Scripting (XSS) vulnerability with admin+ authentication. An attacker can exploit this vulnerability to inject malicious scripts that will be executed in the user's browser context.
A critical vulnerability was found in SourceCodester Game Result Matrix System 1.0, affecting an unknown part of the file /dipam/athlete-profile.php of the GET Parameter Handler component. Manipulation of the argument id leads to SQL injection.