CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Versions of Chamilo v1.11.x up to v1.11.18 were found to contain a cross-site scripting (XSS) vulnerability via the /feedback/comment field.
Versions of Chamilo from v1.11.* up to v1.11.18 have a vulnerability that allows attackers to perform a Server-Side Request Forgery (SSRF). This can lead to obtaining information about services running on the server through crafted requests in the social and links tools.
Incorrect access control in Chamilo 1.11.* up to 1.11.18 allows a student subscribed to a given course to download documents belonging to another student if they know the document's ID.
Thruk versions 3.06 and prior are vulnerable to a Path Traversal attack in the `panorama.pm` file, allowing an attacker to upload files to any folder with write permissions. The location parameter is not filtered or validated.
A stack overflow was discovered in the Tenda AC10 v4 device related to the shareSpeed parameter at the /goform/WifiGuestSet endpoint.
The Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn device was found to contain a stack overflow vulnerability via the devName parameter at the /goform/SetOnlineDevName endpoint.
A stack overflow was discovered in the Tenda AC10 v4 device via parameter list at the /goform/SetNetControlList endpoint.
A stack overflow was discovered in the Tenda AC10 v4 related to the 'time' parameter at the /goform/PowerSaveSet endpoint.
The Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn device was found to contain a stack overflow via parameter list at the endpoint /goform/SetVirtualServerCfg.
D-Bus before 1.15.6 allows unprivileged users to crash dbus-daemon. If a privileged user is monitoring message bus traffic, an unprivileged user can cause a dbus-daemon crash by sending an unreplyable message.
IBM TXSeries for Multiplatforms and CICS TX Standard and Advanced are vulnerable to cross-site scripting (XSS). This vulnerability allows users to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.
The Gatsby framework prior to versions 4.25.7 and 5.9.1 contains a Local File Inclusion vulnerability in the `__file-code-frame` and `__original-stack-frame` paths, which may lead to file exposure when running the development server.
IBM TXSeries for Multiplatforms versions 8.1, 8.2, 9.1, and CICS TX Standard and Advanced versions 10.1, 11.1 may allow a privileged user to obtain highly sensitive information by enabling debug mode.
CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free vulnerability via the function ascii_decode at /Objects/unicodeobject.c.
Marval MSM through version 14.19.0.12476 uses a static encryption key for secrets. An attacker that gains access to encrypted secrets can decrypt them using this key.
A critical vulnerability has been found in SourceCodester Online Discussion Forum Site version 1.0, affecting an unknown part of the file admin\posts\view_post.php. The manipulation leads to SQL injection.
A critical vulnerability was found in SourceCodester Online Discussion Forum Site 1.0, affecting some unknown functionality of the file user/manage_user.php. Manipulation of the argument id leads to SQL injection.
A critical vulnerability was found in SourceCodester Online Discussion Forum Site 1.0, affecting the file posts/manage_post.php. Manipulation of the argument id leads to SQL injection, which can be executed remotely.
The OpenZeppelin Contracts library for smart contract development has a vulnerability that allows an attacker to take over the proposer role by frontrunning the creation of a proposal. The attacker can repeatedly attempt to prevent a proposal from being proposed.
The vulnerability in zxcvbn-ts, a password strength estimator, affects users on the nodeJS platform using the second argument of the zxcvbn function. It can lead to unbounded resource consumption as the user input array is extended with every function call.