CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A critical vulnerability was found in SourceCodester Service Provider Management System 1.0, affecting an unknown part of the file view_service.php. Manipulation of the argument id leads to SQL injection.
A critical vulnerability has been found in SourceCodester Service Provider Management System version 1.0. Manipulation of the 'id' argument in the view.php file leads to SQL injection, which can be exploited remotely.
Minical version 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF) via minical/public/application/controllers/settings/company.php.
Minical version 1.0.0 is vulnerable to Cross Site Scripting (XSS) due to insufficient input validation in the application's user input handling in the security_helper.php file.
In Kanboard, project management software, a vulnerability related to missing access control was identified. A user with the lowest privileges can access the titles of all tasks and projects, even if they are not invited or the project is personal.
Kanboard is project management software that allows for an XSS attack by storing malicious JavaScript code in tasks. Users viewing such a task will be exposed to the XSS attack.
Kanboard, an open source project management software, has a missing access control vulnerability in versions prior to 1.2.30. This allows low-privileged users to create or transfer tasks to any project, even if they have not been invited or the project is personal.
Kanboard, a project management software, has an Insecure Direct Object Reference (IDOR) vulnerability in versions prior to 1.2.30. This allows any user to read files uploaded by other users, regardless of their privileges.
Tamale RMS version < 23.1 from Advent/SSC Inc. is vulnerable to Directory Traversal. An attacker can access contact information, including usernames, email addresses, and other internal data stored within the web app.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository admidio/admidio prior to version 4.2.8, allowing for the storage of malicious code.
A buffer overflow in EasyPlayerPro-Win versions from 3.2.19.0106 to 3.6.19.0823 allows attackers to cause a Denial of Service (DoS) via a crafted XML file.
SonicJS up to v0.7.0 allows attackers to execute an authenticated path traversal when an attacker injects special characters into the filename of a backup CMS.
Versions 11 and later of emoncms have an information disclosure vulnerability that allows attackers to obtain the web directory path and other information leaked by the server via a crafted web request.
A critical vulnerability has been found in IBOS version 4.5.5, affecting the actionDel function in the file ?r=dashboard/approval/del. Manipulation of the argument id leads to SQL injection.
A critical vulnerability was found in KylinSoft youker-assistant on KylinOS in the delete_file function in the dbus.SystemBus library of the Arbitrary File Handler component. Manipulation of this function leads to improper access controls.
A critical vulnerability has been found in KylinSoft youker-assistant on KylinOS in the function restore_all_sound_file, leading to path traversal: '../filedir'. Local exploitation is required.
A critical vulnerability was found in KylinSoft kylin-software-properties on KylinOS, affecting the setMainSource function. Manipulation of this function leads to OS command injection.
A critical vulnerability was found in KylinSoft kylin-software-properties on KylinOS, affecting the changedSource function. Manipulation of this function leads to improper access controls.
An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2 related to TLS certificate validation. The validation does not always consider whether the root of a chain is a configured CA certificate.
DokuWiki before version 2023-04-04a allows XSS via RSS titles.