CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Wtyczka Formcreator dla GLPI umożliwia tworzenie niestandardowych formularzy i zgłoszeń. Podatność na trwałe ataki XSS występuje w wersji 2.13.5 i wcześniejszych poprzez użycie znacznika `##FULLFORM##` do renderowania treści. Może to prowadzić do wykonania dowolnego kodu JavaScript w kontekście administratora lub technika.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository mkucej/i-librarian-free prior to version 5.10.4, allowing for the storage of malicious code.
A reflected Cross-site Scripting (XSS) vulnerability exists in the GitHub repository mkucej/i-librarian-free prior to version 5.10.4.
A critical vulnerability was found in the Lost and Found Information System version 1.0, affecting unknown code in the file /admin/?page=user/list. Manipulation of this code leads to improper access controls.
A critical vulnerability has been found in yiwent Vip Video Analysis 1.0, concerning an unknown functionality of the file data/title.php. Manipulation of the argument titurl leads to server-side request forgery.
In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability was present on the GitLab Connection page.
In JetBrains TeamCity versions before 2023.05, authentication checks were missing – 2FA was not checked for some sensitive account actions.
In JetBrains TeamCity before version 2023.05, a specific endpoint was vulnerable to brute force attacks.
In JetBrains TeamCity versions before 2023.05, a reflected XSS vulnerability was present on the Subscriptions page.
In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability was present in the NuGet feed page.
In JetBrains TeamCity versions before 2023.05, an open redirect vulnerability during oAuth configuration was present.
In JetBrains TeamCity before version 2023.05, 'password' type parameters from build dependencies could be logged in some cases.
In JetBrains TeamCity before version 2023.05, an XSS vulnerability was possible in the Plugin Vendor URL.
In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability existed on the 'Show Connection' page.
In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability was present in the Commit Status Publisher window.
In JetBrains TeamCity versions before 2023.05, improper permission checks allowed users without appropriate permissions to edit Build Configuration settings via REST API.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository nilsteampassnet/teampass prior to version 3.0.9, allowing for the storage of malicious code.
Dcat-Admin v2.1.3-beta has a stored cross-site scripting (XSS) vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter.
A critical vulnerability was found in ningzichun Student Management System version 1.0. The issue affects some unknown functionality of the file resetPassword.php in the Password Reset Handler component, where manipulation of the argument sid leads to weak password recovery.
A critical vulnerability has been found in Simple Chat System 1.0, allowing SQL injection through manipulation of the convo_id parameter in the /ajax.php?action=read_msg file. The attack can be launched remotely.