CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
EyouCMS version 1.6.3 has a cross site scripting (XSS) vulnerability in the filing number on the backend management page under the Basic Information tab.
The WP Overnight Quick/Bulk Order Form for WooCommerce plugin versions <= 3.5.7 has a stored Cross-Site Scripting (XSS) vulnerability with admin+ privileges.
The realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin versions up to 1.0.7 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of a logged-in user.
Casdoor v1.331.0 and below was found to contain a Cross-Site Request Forgery (CSRF) vulnerability in the /api/set-password endpoint. This vulnerability allows attackers to arbitrarily change the victim user's password by supplying a crafted URL.
The Kanban Boards plugin for WordPress versions up to 2.5.20 has a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will execute in the context of administrative users.
The Marco Milesi Telegram Bot & Channel plugin versions up to 3.6.2 has a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+). An attacker can exploit this flaw to inject malicious scripts that will execute in the context of users' browsers.
The ARMember plugin versions up to 4.0.2 contain a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will execute in the context of users with admin privileges.
The WooCommerce PayPal Payments plugin versions <= 2.0.4 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.
The MasterStudy LMS plugin for WordPress versions <= 3.0.8 has a broken access control vulnerability that allows logged-in users, such as subscribers, to view the plugin's orders and obtain order-related data like email, username, and more.
Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting (XSS). The application dynamically builds web page parts using user inputs without proper verification or filtering, allowing injection of malicious HTML/JavaScript code. This code is saved and executed in the victim's browser.
The MasterStudy LMS plugin for WordPress versions <= 3.0.7 has a stored Cross-Site Scripting (XSS) vulnerability for contributor+ users.
A reflected cross-site scripting (XSS) vulnerability in DATEV eG Personal-Management System Comfort/Comfort Plus versions 15.1.0 to 16.1.1 P4 allows attackers to steal targeted users' login data by sending a crafted link.
IBM SPSS Modeler on Windows versions 17.0, 18.0, 18.2.2, 18.3, 18.4, and 18.5 requires the end user to have access to the server SSL key, which could allow a local user to decrypt and obtain sensitive information.
Blogengine.net version 3.3.8.0 and earlier is vulnerable to Open Redirect, which may allow attackers to redirect users to malicious sites.
A cross-site scripting (XSS) vulnerability was discovered in User Registration & Login and User Management System v1.0 via the component /admin/search-result.php.
Broadleaf 5.x and 6.x (including 5.2.25-GA and 6.2.6-GA) was found to contain a cross-site scripting (XSS) vulnerability via a customer signup with a crafted email address. This issue is fixed in version 6.2.6.1-GA.
A critical vulnerability has been found in Agro-School Management System version 1.0. Manipulation of the test_id argument in the exam-delete.php file leads to SQL injection, which can be exploited remotely.
An issue was discovered in the Linux kernel through 6.1-rc8 related to the lack of checking the return value of kzalloc() in dpu_crtc_atomic_check, leading to a NULL Pointer Dereference.
Enphase Envoy version D7.0.88 is vulnerable to a command injection exploit that may allow an attacker to execute root commands.
A critical vulnerability was found in SourceCodester Online School Fees System version 1.0. The issue affects some unknown functionality of the file ajx.php in the GET Parameter Handler component, where manipulation of the argument name_startsWith leads to SQL injection.