CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
DataEase is a data visualization analysis tool that, in affected versions, has a missing authorization check. This allows unauthorized users to manipulate dashboards created by the administrator.
DataEase, a data visualization analysis tool, has a privilege bypass vulnerability that allows ordinary users to access the user database. Exposed information includes md5 hashes of passwords, usernames, email addresses, and phone numbers.
OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and ListObjects calls are executed against authorization models that contain circular relationship definitions. Users are affected if they are using these versions and executing these calls on vulnerable models.
An authenticated LXCA user with elevated privileges may delete folders in the LXCA filesystem through a specifically crafted web API call due to insufficient input validation.
An authenticated LXCA user with elevated privileges may replace filesystem data through a specifically crafted web API call due to insufficient input validation.
BigBlueButton, an open-source virtual classroom, has a Server-Side Request Forgery (SSRF) vulnerability in affected versions that allows users to supply a URL for downloading presentations without prior validation. An update to the `followRedirect` method has been made to validate all URLs used for presentation downloads.
Phpgurukul Student Study Center Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in the 'Admin Name' field on the Admin Profile page.
An issue was discovered in MediaWiki before 1.35.11, and in versions 1.36.x through 1.38.x before 1.38.7, and 1.39.x before 1.39.4, allowing XSS in the partial blocks feature in BlockLogFormatter.php.
The TechTime User Management components for Atlassian products allow stored XSS on the Bulk User Actions page. This affects User Management for Jira versions 2.0.0 through 2.17.1, User Management for Confluence versions 2.0.0 through 2.15.24, and User Management for Bitbucket versions 2.2.2 through 2.15.24.
INEX IXP-Manager versions before 6.3.1 are vulnerable to XSS attacks. This affects files such as list-preamble.foil.php, page-header-preamble.foil.php, edit-form.foil.php, overview.foil.php, cust.foil.php, and view.foil.php.
A critical vulnerability was found in Campcodes Retro Cellphone Online Store version 1.0. Manipulation of the username/password arguments in the /admin/index.php file leads to SQL injection, which can be executed remotely.
The Lana Text to Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'lana_text_to_image' and 'lana_text_to_img' shortcode in versions up to and including 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes.
The Nextcloud End-to-end encryption app provides the ability to implement end-to-end encryption on the client side. By providing an invalid metadata file, an attacker can make previously dropped files inaccessible.
NextCloud Server and NextCloud Enterprise Server provide file storage for a productivity platform. In versions 26.0.0 to 26.0.2, an attacker could supply a URL that redirects an unsuspecting user from a legitimate domain to an attacker's site.
The AWS Cloud Development Kit (AWS CDK) has a vulnerability related to overly permissive trust policies for the `CreationRole` and `default MastersRole` in versions `aws-cdk-lib` from 2.0.0 to 2.80.0 and `@aws-cdk/aws-eks` from 1.57.0 to 1.202.0.
Vega is a decentralized trading platform that prior to version 0.71.6 had a vulnerability allowing a malicious validator to trick the Vega network into re-processing past Ethereum events. This could lead to unauthorized increases in a user's account balance without additional deposits.
A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it has been freed and set to NULL.
Version 2.0 of POS Codekop was found to contain a reflected XSS vulnerability via the nm_member parameter in print.php.
In Progress WhatsUp Gold before version 23.0.0 has an SNMP-related application endpoint that fails to adequately sanitize malicious input. This could allow an unauthenticated attacker to execute arbitrary code in a victim's browser, known as XSS.
Remult is a CRUD framework for full-stack TypeScript. Using the apiPrefilter option in the @Entity decorator as a function intended to prevent unauthorized access to data may allow an attacker, knowing the id of an entity instance, to gain read, update, and delete access to it.