CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Improper limitation of a pathname leads to a Path Traversal vulnerability in the King-Avis module for Prestashop, allowing a user knowing the download token to read arbitrary local files. This issue affects King-Avis versions before 17.3.15.
A vulnerability was found in YFCMF up to version 3.0.4, affecting unknown code in the index.php file. The manipulation leads to path traversal: '../filedir'.
The eScan management console by Microworld Technologies version 14.0.1400.2281 has a reflected Cross Site Scripting (XSS) vulnerability in the view dashboard detail feature. This allows a remote attacker to inject arbitrary code via the URL.
mp4v2 v2.1.3 was discovered to contain a memory leak when a method calling MP4File::ReadBytes() had allocated memory but did not catch exceptions thrown by ReadBytes().
The BT21 x BTS Wallpaper app 12 for Android allows unauthorized apps to request permission to insert data into the user preferences database. Injecting malicious image URLs causes memory overload and app crashes.
eMedia Consulting simpleRedak up to version 2.47.23.05 was found to contain a stored cross-site scripting (XSS) vulnerability via the component #/de/casting/show/detail/<ID>.
The captive portal in Inpiazza Cloud WiFi versions prior to v4.2.17 does not enforce limits on the number of attempts for password recovery, allowing attackers to brute force valid user accounts to gain access to login credentials.
Kyverno, a policy engine designed for Kubernetes, in versions prior to 1.10.0 allowed resources with the `deletionTimestamp` field defined to bypass validation, generation, or mutation policies. Resources pending deletion were consciously exempted from processing, which could enable malicious users to manipulate policies.
Janino 3.1.9 and earlier are subject to denial of service (DOS) attacks when using the expression evaluator.guess parameter name method. If the parser runs on user-supplied input, an attacker could supply content that causes the parser to crash due to a stack overflow.
Hawtio version 2.17.2 is vulnerable to Path Traversal. It is possible to input malicious zip files, which can result in high-risk files being stored in any location, even leading to file overwrite.
A vulnerability has been found in Guangdong Pythagorean OA Office System up to version 4.50.31, allowing cross-site request forgery (CSRF) attacks through manipulation of the id argument in the /note/index/delete file.
Version 2.1.3 of the mp4v2 library was found to contain a memory leak in the MP4SdpAtom::Read() function in atom_sdp.cpp.
Version 2.1.3 of the mp4v2 library was found to contain a memory leak in the MP4StringProperty class in mp4property.cpp.
Version 4.1 of the iniparser library is vulnerable to NULL Pointer Dereference in the iniparser_getlongint function, which misses a NULL check for the return of the iniparser_getstring function.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository jgraph/drawio prior to version 21.2.8, allowing for the storage of malicious code.
A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, affects the new hardware AmpereOne. Spectre-BHB uses shared branch history to influence mispredicted branches within the victim's hardware context.
An issue was discovered in the Linux kernel before version 6.3.3 related to an out-of-bounds read in the crc16 function in lib/crc16.c when called from fs/ext4/super.c. The problem arises from improper offset checking in the ext4_group_desc_csum function.
The New Policy form in the Microworld Technologies eScan management console has a Cross Site Scripting (XSS) vulnerability that allows a remote attacker to inject arbitrary code via the vulnerable parameters type, txtPolicyType, and Deletefileval.
A stored cross-site scripting (XSS) vulnerability in the Inline Table Editing application before 3.8.0 for Confluence allows attackers to store and execute arbitrary JavaScript via a crafted payload injected into the tables.
A vulnerability was found in gpt_academic version 3.37 and prior, allowing information disclosure through manipulation of the file argument in the Configuration File Handler component. This enables reading sensitive configuration files in some working directories.