CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A stack-based buffer overflow issue was found in ImageMagick's coders/tiff.c. This flaw allows an attacker to trick the user into opening a specially crafted malicious tiff file, causing an application to crash, resulting in a denial of service.
A heap use after free issue was discovered in ImageMagick's ReplaceXmpValue() function. An attacker could trick a user into opening a specially crafted file, triggering a heap-use-after-free write error, causing an application crash and resulting in a denial of service.
A heap-based buffer overflow issue was discovered in ImageMagick's ReadTIM2ImageData() function in coders/tim2.c. A local attacker could trick the user into opening a specially crafted file, triggering an out-of-bounds read error, which may cause the application to crash.
Version 3.5.0 of jjeecg-boot has an unauthorized arbitrary file upload in the /jeecg-boot/jmreport/upload interface.
A lack of exception handling in the Volkswagen Discover Media Infotainment System Software Version 0876 allows attackers to cause a Denial of Service (DoS) via supplying crafted media files when connecting a device to the vehicle's USB plug and play feature.
The ke_search extension (aka Faceted Search) before 4.0.3, 4.1.x through 4.6.x before 4.6.6, and 5.x before 5.0.2 for TYPO3 allows XSS via indexed data.
In the GitHub repository saleor/react-storefront prior to version c29aab226f07ca980cc19787dcef101e11b83ef7, there is a Cross-site Scripting (XSS) vulnerability in the DOM context.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository salesagility/suitecrm-core prior to version 8.3.0, allowing for the storage of malicious code.
A null pointer dereference in Fortinet FortiOS before 7.2.5 and before 7.0.11, FortiProxy before 7.2.3 and before 7.0.9 allows attacker to denial of sslvpn service via specifically crafted request in network parameter.
A null pointer dereference in Fortinet FortiOS before 7.2.5, before 7.0.11, and before 6.4.13, and in FortiProxy before 7.2.4 and before 7.0.10 allows an attacker to cause denial of service for sslvpn via a specifically crafted request in the bookmark parameter.
CVE-2023-34165 describes an unauthorized access vulnerability in the 'Save for later' feature provided by AI Touch. Successful exploitation may allow third-party apps to forge a URI for unauthorized access with zero permissions.
Bludit v3.14.1 was discovered to contain an arbitrary file upload vulnerability in the component /admin/new-content. This vulnerability allows attackers to execute arbitrary web scripts or HTML via uploading a crafted SVG file.
There is a broken access control in the Registration page (/Registration.aspx) of Termenos CWX v8.5.6 that allows attackers to access sensitive information.
An arbitrary file upload vulnerability in the /api/upload.php component of ThinkAdmin v6 allows attackers to execute arbitrary code via a crafted file.
The Phpgurukul Cyber Cafe Management System version 1.0 has a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web scripts or HTML via the admin username parameter.
The snappy-java library has an issue with unchecked multiplications that may lead to integer overflow in versions prior to 1.1.10.1. The `compress(char[] input)` function does not check the length of the array, which can result in critical errors.
The snappy-java library has a vulnerability related to unchecked multiplications, which may lead to integer overflow in versions prior to 1.1.10.1. The `shuffle(int[] input)` function can cause a critical error when the array length is not properly checked.
Piwigo version 13.7.0 is vulnerable to SQL Injection via the 'Users' function.
A vulnerability has been found in Dromara HuTool up to version 5.8.19 in the function readBySax of the file XmlUtil.java, leading to XML external entity reference. The issue has been disclosed publicly and may be exploited.
A critical vulnerability was found in PHPGurukul Rail Pass Management System version 1.0. Manipulation of the argument searchdata in the file /view-pass-detail.php leads to SQL injection, allowing for remote attacks.