CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A critical vulnerability has been identified in the Wavlink WN579X3 device up to version 20230615, concerning an unknown function of the file /cgi-bin/adm.cgi in the Ping Test component. Manipulation of the pingIp argument leads to injection.
The vulnerability in `SniHandler` in the Netty framework allows for the allocation of up to 16MB of heap for each channel during the TLS handshake. The lack of proper checks enables the crafting of a packet that can exploit this allocation, potentially leading to resource exhaustion.
CUPS versions from 2.0.0 to 2.4.6 contain a use-after-free bug that causes logging of free memory data after the connection has been closed, instead of before. This issue affects the entire cupsd process.
Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agents. This authorization flaw could potentially allow a workspace to access resources from a separate, higher-privileged workspace in the same organization.
A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.
The groups page in Moodle has a vulnerability that requires additional content sanitization to prevent XSS risk. This issue affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, and 3.11 to 3.11.14.
An issue was discovered in WAFU Keyless Smart Lock v1.0 that allows attackers to unlock a device via code replay attack.
In versions 1.1 and through commit 8a1d882b4c481a05e296e9b38a7961e912146a0f of the dmarcts-report-viewer dashboard, there is a cross site scripting (XSS) vulnerability. It allows unauthenticated attackers to execute arbitrary code via the org_name or domain values.
EyouCMS version 1.6.3 has a cross site scripting (XSS) vulnerability in the filing number on the backend management page under the Basic Information tab.
The WP Overnight Quick/Bulk Order Form for WooCommerce plugin versions <= 3.5.7 has a stored Cross-Site Scripting (XSS) vulnerability with admin+ privileges.
The realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin versions up to 1.0.7 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of a logged-in user.
Casdoor v1.331.0 and below was found to contain a Cross-Site Request Forgery (CSRF) vulnerability in the /api/set-password endpoint. This vulnerability allows attackers to arbitrarily change the victim user's password by supplying a crafted URL.
The Kanban Boards plugin for WordPress versions up to 2.5.20 has a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will execute in the context of administrative users.
The Marco Milesi Telegram Bot & Channel plugin versions up to 3.6.2 has a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+). An attacker can exploit this flaw to inject malicious scripts that will execute in the context of users' browsers.
The ARMember plugin versions up to 4.0.2 contain a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will execute in the context of users with admin privileges.
The WooCommerce PayPal Payments plugin versions <= 2.0.4 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.
The MasterStudy LMS plugin for WordPress versions <= 3.0.8 has a broken access control vulnerability that allows logged-in users, such as subscribers, to view the plugin's orders and obtain order-related data like email, username, and more.
Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting (XSS). The application dynamically builds web page parts using user inputs without proper verification or filtering, allowing injection of malicious HTML/JavaScript code. This code is saved and executed in the victim's browser.
The MasterStudy LMS plugin for WordPress versions <= 3.0.7 has a stored Cross-Site Scripting (XSS) vulnerability for contributor+ users.
A reflected cross-site scripting (XSS) vulnerability in DATEV eG Personal-Management System Comfort/Comfort Plus versions 15.1.0 to 16.1.1 P4 allows attackers to steal targeted users' login data by sending a crafted link.