CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
AMI BMC contains a vulnerability in the SPX REST API, allowing an attacker with the required privileges to access arbitrary files, which may lead to information disclosure.
AMI BMC contains a vulnerability in the IPMI handler, allowing an unauthorized attacker to use certain oracles to guess a valid username, which may lead to information disclosure.
Doorkeeper, an OAuth 2 provider for Ruby on Rails / Grape, prior to version 5.6.6 automatically processes authorization requests without user consent for previously approved public clients. This creates a risk of impersonation.
In JetBrains YouTrack versions before 2023.1.10518, a stored XSS vulnerability in the Markdown-rendering engine was present.
The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors in Apache NiFi versions 1.8.0 through 1.21.0, allows an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location.
A critical vulnerability has been found in RoadFlow Visual Process Engine .NET Core Mvc 2.13.3, affecting an unknown functionality of the file /Log/Query. Manipulation of the arguments sidx/sord leads to SQL injection, which can be exploited remotely.
A vulnerability was found in Chengdu VEC40G 3.0 that allows remote denial of service by manipulating the 'restart' argument in the /send_order.cgi file. Inputting 'reboot' leads to system failure.
A Cross Site Scripting (XSS) vulnerability in Youxun Electronic Equipment (Shanghai) Co., Ltd AC Centralized Management Platform v1.02.040 allows attackers to execute arbitrary code via uploading a crafted HTML file to the interface /upfile.cgi.
EyouCMS version 1.6.2 is vulnerable to Cross Site Scripting (XSS) attacks, which may allow attackers to inject malicious code into the application.
Session Fixation vulnerability in GitHub repository froxlor/froxlor prior to version 2.1.0.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository nilsteampassnet/teampass prior to version 3.0.9, allowing for the storage of malicious code.
Improper encoding or escaping of output in GitHub repository nilsteampassnet/teampass prior to version 3.0.9.
There is a Server-Side Request Forgery (SSRF) vulnerability in the GitHub repository owncast/owncast prior to version 0.1.0. An attacker can exploit this flaw to send requests to internal server resources.
A critical vulnerability has been found in PHPGurukul Teachers Record Management System version 1.0. The issue affects an unknown functionality of the file /changeimage.php, where manipulation of the argument newpic leads to unrestricted file uploads.
A Cross Site Scripting (XSS) vulnerability in D-Link DI-7500G-CI-19.05.29A allows attackers to execute arbitrary code via uploading a crafted HTML file to the interface /auth_pic.cgi.
An issue was discovered in Progress DataDirect Connect for ODBC before version 08.02.2770 for Oracle. When using Oracle Advanced Security (OAS) encryption, if an error occurs while initializing the encryption object, the code falls back to a different encryption mechanism that uses an insecure random number generator to generate the private key.
A critical vulnerability has been found in SourceCodester Lost and Found Information System version 1.0, affecting an unknown functionality of the file admin\inquiries\view_inquiry.php. Manipulation of this functionality leads to SQL injection.
A critical vulnerability was found in the Lost and Found Information System version 1.0, allowing SQL injection through manipulation of the id argument in the admin\user\manage_user.php file.
JavaCPP Presets uses the `github.event.head_commit.message` parameter insecurely, leading to a command injection vulnerability. This issue has been addressed in version 1.5.9.
CVE-2023-34243 affects the TGstation toolset that manages BYOND servers. In affected versions, an attacker could discover a Windows username by brute-forcing the login endpoint with an invalid password.