CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A critical vulnerability was found in miniCal 1.0.0, affecting unknown processing of the file /booking/show_bookings/. Manipulation of the argument search_query leads to SQL injection.
The OpenZeppelin Contracts library, from version 4.7.0 to 4.9.2, contains a vulnerability that allows the construction of merkle trees enabling the forging of valid multiproofs for any set of leaves. The vulnerability occurs when using multiproof functions and the merkle tree contains a node with a value of 0 at depth 1.
An issue was discovered in the C AMQP client library (aka rabbitmq-c) through 0.13.0 for RabbitMQ, allowing credentials to be entered only on the command line. This makes credentials visible to local attackers by listing a process and its arguments.
A stored Cross-site scripting (XSS) vulnerability in Wolters Kluwer TeamMate+ 35.0.11.0 allows remote attackers to inject arbitrary web script or HTML.
A stack-based buffer overflow issue was found in ImageMagick's coders/tiff.c. This flaw allows an attacker to trick the user into opening a specially crafted malicious tiff file, causing an application to crash, resulting in a denial of service.
A heap use after free issue was discovered in ImageMagick's ReplaceXmpValue() function. An attacker could trick a user into opening a specially crafted file, triggering a heap-use-after-free write error, causing an application crash and resulting in a denial of service.
A heap-based buffer overflow issue was discovered in ImageMagick's ReadTIM2ImageData() function in coders/tim2.c. A local attacker could trick the user into opening a specially crafted file, triggering an out-of-bounds read error, which may cause the application to crash.
Version 3.5.0 of jjeecg-boot has an unauthorized arbitrary file upload in the /jeecg-boot/jmreport/upload interface.
A lack of exception handling in the Volkswagen Discover Media Infotainment System Software Version 0876 allows attackers to cause a Denial of Service (DoS) via supplying crafted media files when connecting a device to the vehicle's USB plug and play feature.
The ke_search extension (aka Faceted Search) before 4.0.3, 4.1.x through 4.6.x before 4.6.6, and 5.x before 5.0.2 for TYPO3 allows XSS via indexed data.
In the GitHub repository saleor/react-storefront prior to version c29aab226f07ca980cc19787dcef101e11b83ef7, there is a Cross-site Scripting (XSS) vulnerability in the DOM context.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository salesagility/suitecrm-core prior to version 8.3.0, allowing for the storage of malicious code.
A null pointer dereference in Fortinet FortiOS before 7.2.5 and before 7.0.11, FortiProxy before 7.2.3 and before 7.0.9 allows attacker to denial of sslvpn service via specifically crafted request in network parameter.
A null pointer dereference in Fortinet FortiOS before 7.2.5, before 7.0.11, and before 6.4.13, and in FortiProxy before 7.2.4 and before 7.0.10 allows an attacker to cause denial of service for sslvpn via a specifically crafted request in the bookmark parameter.
CVE-2023-34165 describes an unauthorized access vulnerability in the 'Save for later' feature provided by AI Touch. Successful exploitation may allow third-party apps to forge a URI for unauthorized access with zero permissions.
Bludit v3.14.1 was discovered to contain an arbitrary file upload vulnerability in the component /admin/new-content. This vulnerability allows attackers to execute arbitrary web scripts or HTML via uploading a crafted SVG file.
There is a broken access control in the Registration page (/Registration.aspx) of Termenos CWX v8.5.6 that allows attackers to access sensitive information.
An arbitrary file upload vulnerability in the /api/upload.php component of ThinkAdmin v6 allows attackers to execute arbitrary code via a crafted file.
The Phpgurukul Cyber Cafe Management System version 1.0 has a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web scripts or HTML via the admin username parameter.
The snappy-java library has an issue with unchecked multiplications that may lead to integer overflow in versions prior to 1.1.10.1. The `compress(char[] input)` function does not check the length of the array, which can result in critical errors.