CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The 1.4.0 release of the Tauri framework introduced a regression in the filesystem scope check for dotfiles on Unix. Previously, dotfiles were not implicitly allowed by wildcard patterns, which changed due to the implementation of a configuration option.
There is a Session Fixation vulnerability in the GitHub repository fossbilling/fossbilling prior to version 0.5.1.
The Elenos ETG150 FM transmitter running version 3.12 was found leaking SMTP credentials and other sensitive information by exploiting the publicly accessible Memcached service. The attack can occur over the public Internet in some cases.
A critical vulnerability was found in SourceCodester Human Resource Management System version 1.0. Manipulation of the employeeid argument in the detailview.php file leads to SQL injection.
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter.
A vulnerability in FastAsyncWorldEdit (FAWE) allows an attacker to select a region using the `Infinity` keyword, enabling any operation to be executed. This could potentially bring the server down.
The XWiki Platform has a vulnerability that allows tags from pages not viewable to the current user to be leaked via the tags API. This information can be exploited to infer the document reference of non-viewable pages.
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie. This enables the attacker to impersonate that user via POST email_create and back parameter.
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via GET configure parameter.
Improper access control exists in the GitHub repository admidio/admidio prior to version 4.2.9.
The MagePeople Team Booking and Rental Manager for Bike plugin versions <= 1.2.1 has a stored Cross-Site Scripting (XSS) vulnerability with admin+ authentication. An attacker can exploit this vulnerability to inject malicious scripts that will be executed in the user's browser context.
A critical vulnerability was found in SourceCodester Game Result Matrix System 1.0, affecting an unknown part of the file /dipam/athlete-profile.php of the GET Parameter Handler component. Manipulation of the argument id leads to SQL injection.
A critical vulnerability has been identified in the Wavlink WN579X3 device up to version 20230615, concerning an unknown function of the file /cgi-bin/adm.cgi in the Ping Test component. Manipulation of the pingIp argument leads to injection.
The vulnerability in `SniHandler` in the Netty framework allows for the allocation of up to 16MB of heap for each channel during the TLS handshake. The lack of proper checks enables the crafting of a packet that can exploit this allocation, potentially leading to resource exhaustion.
CUPS versions from 2.0.0 to 2.4.6 contain a use-after-free bug that causes logging of free memory data after the connection has been closed, instead of before. This issue affects the entire cupsd process.
Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agents. This authorization flaw could potentially allow a workspace to access resources from a separate, higher-privileged workspace in the same organization.
A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.
The groups page in Moodle has a vulnerability that requires additional content sanitization to prevent XSS risk. This issue affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, and 3.11 to 3.11.14.
An issue was discovered in WAFU Keyless Smart Lock v1.0 that allows attackers to unlock a device via code replay attack.
In versions 1.1 and through commit 8a1d882b4c481a05e296e9b38a7961e912146a0f of the dmarcts-report-viewer dashboard, there is a cross site scripting (XSS) vulnerability. It allows unauthenticated attackers to execute arbitrary code via the org_name or domain values.