CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in Apache Struts related to resource allocation without limits or throttling. Affects Apache Struts versions up to 2.5.30 and 6.1.2.
There is a vulnerability in Apache Struts related to resource allocation without limits or throttling. This issue affects Apache Struts versions up to 2.5.30 and 6.1.2.
A critical vulnerability has been found in mccms up to version 2.6.5, affecting the pic_save function in the file sys/apps/controllers/admin/Comic.php. Manipulation of the pic argument leads to server-side request forgery, which can be initiated remotely.
A critical vulnerability was found in mccms versions up to 2.6.5 in the pic_api function of the file sys/apps/controllers/admin/Comic.php. Manipulation of the url argument leads to server-side request forgery.
A vulnerability was found in Zhong Bang CRMEB up to version 4.6.0, affecting the put_image function in the file api/controller/v1/PublicController.php. The manipulation leads to deserialization, allowing for remote attacks.
A critical vulnerability was found in Zhong Bang CRMEB up to version 4.6.0, affecting the get_image_base64 function in the api/controller/v1/PublicController.php file. Manipulation of this function leads to server-side request forgery.
A critical vulnerability was found in Zhong Bang CRMEB up to version 4.6.0, affecting some unknown processing of the file /api/wechat/app_auth in the Image Upload component. The manipulation leads to deserialization, which may be exploited by attackers.
Business logic errors in the GitHub repository fossbilling/fossbilling prior to version 0.5.0 may lead to unauthorized access or improper data processing.
Business Logic Errors in the GitHub repository fossbilling/fossbilling prior to version 0.5.0 may lead to unauthorized access or improper data processing.
Insufficient granularity of access control exists in the GitHub repository fossbilling/fossbilling prior to version 0.5.0.
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_limit_product function. This allows unauthenticated attackers to update the limit of products per category via a forged request if they can trick a site administrator into performing an action such as clicking on a link.
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_order_title function. This allows unauthenticated attackers to update new order titles via a forged request if they can trick a site administrator into performing an action such as clicking on a link.
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_order_message function. This allows unauthenticated attackers to update new order messages via a forged request if they can trick a site administrator into performing an action such as clicking on a link.
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_status_order_message function. This allows unauthenticated attackers to update status order messages via a forged request if they can trick a site administrator into performing an action such as clicking on a link.
A vulnerability in Microsoft Edge (Chromium-based) allows for information disclosure. This may lead to unauthorized access to user data.
A vulnerability in Visual Studio Code allows for spoofing, which may lead to unauthorized access to user data. An attacker can exploit this flaw to mislead the user into performing unsafe actions.
A vulnerability in Microsoft SharePoint Server allows for elevation of privileges, potentially leading to unauthorized access to system resources.
A vulnerability in Microsoft OneNote allows for spoofing, which can lead to unauthorized access to user data. An attacker can exploit this flaw to impersonate a trusted source and mislead users.
A vulnerability in Visual Studio allows for information disclosure, potentially leading to unauthorized access to sensitive data.
A vulnerability in Microsoft SharePoint Server allows for spoofing, potentially leading to unauthorized access to user data.