CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Flothemes Flo Forms plugin versions up to 1.0.40 contains a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+). An attacker can exploit this vulnerability to inject malicious scripts that will be executed in the context of administrative users.
A vulnerability in Fibaro Motion Sensor firmware v3.4 allows attackers to cause a Denial of Service (DoS) via a crafted Z-Wave message.
A vulnerability in Aeotec WallMote Switch firmware v2.3 allows attackers to cause a Denial of Service (DoS) via a crafted Z-Wave message.
Craft CMS versions up to 4.4.9 are vulnerable to HTML Injection.
The Team Heateor Super Socializer plugin versions up to 7.13.52 contains a stored Cross-Site Scripting (XSS) vulnerability for users with contributor permissions and above.
The Extra User Details plugin by Vadym K. in versions up to 0.5 has a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+).
The WP Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.0.1. This is due to missing nonce validation in the ~/admin/views/admin.php file, allowing unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request.
Missing permission checks in Jenkins Team Concert Plugin 2.4.1 and earlier allow attackers with Overall/Read permission to check for the existence of a specified file path on the Jenkins controller file system.
A flaw was found in the IPv6 module of the Linux kernel, involving inconsistent use of arg.result in fib6_rule_lookup. This may lead to a kernel panic in fib6_rule_suppress.
PyBB is an open source bulletin board software that contains a vulnerability allowing users to submit any type of HTML tag, which could lead to the execution of malicious JavaScript code on the client side. The issue has been patched in version 0.1.1, and users are advised to upgrade.
Vulnerability of spoofing trustlists of Huawei desktop. Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the desktop to prevent them from being uninstalled.
Vulnerability of spoofing trustlists of Huawei desktop. Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the desktop to prevent them from being uninstalled.
Vulnerability of spoofing trustlists of Huawei desktop. Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the desktop to prevent them from being uninstalled.
Vulnerability in services related to early fingerprint APIs on HarmonyOS products. Successful exploitation of this vulnerability may lead to denial of service.
The Seed Fonts plugin versions up to 2.3.1 contains a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will execute in the context of users with admin privileges.
The Beplus Sermon'e – Sermons Online plugin versions up to 1.0.0 has a stored Cross-Site Scripting (XSS) vulnerability for users with contributor privileges and above.
The Dylan James Zephyr Project Manager plugin versions <= 3.3.93 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.
The wpView plugin versions up to 1.3.0 contain a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will execute in the context of users' browsers.
A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file, which may occur due to a non-existent path or a path requiring permissions, such as /dev/null, while specifying zones.
A vulnerability in Firefox allowed a document loaded from a data: URL resulting from a redirect to be loaded in the same process as the site that issued the redirect, bypassing site-isolation protections against Spectre-like attacks.