CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Improper Access Control exists in GitHub repository nilsteampassnet/teampass prior to version 3.0.9.
A critical vulnerability has been found in the Agro-School Management System 1.0. Manipulation of the argument question_id in the doUpdateQuestion function of the btn_functions.php file leads to SQL injection.
The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.27.133. This is due to missing or incorrect nonce validation on the 'azh_save' function, allowing unauthenticated attackers to update post content and inject malicious JavaScript.
The Page Builder by AZEXO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'azh_add_post' function in versions up to and including 1.27.133. This allows authenticated attackers to create posts of any type and status.
The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.27.133. This is due to missing or incorrect nonce validation on the 'azh_add_post', 'azh_duplicate_post', 'azh_update_post', and 'azh_remove_post' functions.
The Page Builder by AZEXO plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via 'azh_post' shortcode in versions up to and including 1.27.133 due to insufficient input sanitization and output escaping.
eMedia Consulting simpleRedak up to version 2.47.23.05 was discovered to contain a reflected XSS vulnerability via the component /scheduler/index.php.
eMedia Consulting simpleRedak up to version 2.47.23.05 was found to contain a reflected XSS vulnerability via the component /view/cb/format_642.php.
A Cross-site Scripting (XSS) vulnerability was identified in the GitHub repository tsolucio/corebos prior to version 8 via evvtgendoc.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the GitHub repository tsolucio/corebos prior to version 8. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated user.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository tsolucio/corebos prior to version 8, allowing malicious code to be stored in the application.
A Cross-site Scripting (XSS) vulnerability - Stored in the GitHub repository tsolucio/corebos prior to version 8.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository tsolucio/corebos prior to version 8, allowing malicious code to be stored in the application.
A critical vulnerability has been found in Campcodes Retro Cellphone Online Store version 1.0. Manipulation of the 'category' argument in the /admin/modal_add_product.php file leads to SQL injection, allowing for remote attack execution.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository zadam/trilium prior to version 0.59.4, allowing for the storage of malicious code.
A critical vulnerability was found in the Agro-School Management System version 1.0. Manipulation of the 'password' argument in the index.php file leads to SQL injection.
A critical vulnerability was found in the Agro-School Management System version 1.0. This issue affects some unknown processing of the file btn_functions.php of the Attachment Image Handler component, leading to unrestricted file uploads.
A critical vulnerability was found in SourceCodester Online Exam Form Submission 1.0, affecting the file /admin/update_s6.php. Manipulation of the argument id leads to SQL injection.
A vulnerability was found in YFCMF up to 3.0.4, allowing path traversal attacks through manipulation of the controllername argument in app/admin/controller/Ajax.php.
The Mobatime web application has an incorrect authorization vulnerability that allows privilege escalation through incorrectly configured access control security levels.