CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability was present in the Commit Status Publisher window.
In JetBrains TeamCity versions before 2023.05, improper permission checks allowed users without appropriate permissions to edit Build Configuration settings via REST API.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository nilsteampassnet/teampass prior to version 3.0.9, allowing for the storage of malicious code.
Dcat-Admin v2.1.3-beta has a stored cross-site scripting (XSS) vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter.
A critical vulnerability was found in ningzichun Student Management System version 1.0. The issue affects some unknown functionality of the file resetPassword.php in the Password Reset Handler component, where manipulation of the argument sid leads to weak password recovery.
A critical vulnerability has been found in Simple Chat System 1.0, allowing SQL injection through manipulation of the convo_id parameter in the /ajax.php?action=read_msg file. The attack can be launched remotely.
A critical vulnerability was found in SourceCodester Train Station Ticketing System version 1.0. Manipulation of the 'id' argument in the manage_prices.php file leads to SQL injection, which can be exploited remotely.
A vulnerability was found in ImageMagick, occurring due to undefined behaviors of casting double to size_t in svg, mvg and other coders. This is a recurring bug related to CVE-2022-32546.
JStachio is a type-safe Java Mustache templating engine. Prior to version 1.0.1, JStachio fails to escape single quotes `'` in HTML, allowing an attacker to inject malicious code.
Xibo is a content management system (CMS) that in versions from 3.0.0 to 3.3.5 reveals sensitive information by printing stack traces when certain API routes are called with missing or invalid parameters. Users should upgrade to version 3.3.5, which fixes this issue.
An SQL injection vulnerability was discovered in the Xibo content management system in the `/display/map` API route, affecting versions from 3.2.0 to 3.3.2. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values into the `bounds` parameter.
An SQL injection vulnerability was discovered in the `nameFilter` function in the Xibo content management system, affecting versions from 3.2.0 to 3.3.5. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values for logical operators.
An SQL injection vulnerability was discovered in the Xibo content management system in the `/dataset/data/{id}` API. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values into the `filter` parameter.
A memory leak vulnerability exists in NanoMQ version 0.17.2. The issue is located in the file message.c and could be exploited by an attacker to perform a denial of service attack by consuming all available memory resources.
Minio Console, the UI for MinIO Object Storage, is vulnerable to the use of Unicode RIGHT-TO-LEFT OVERRIDE characters, allowing the original filename to be masked.
Kyverno is a policy engine designed for Kubernetes. Seccomp control in Kyverno can be circumvented, affecting users of the `validate.podSecurity` subrule in versions 1.9.2 and 1.9.3. This issue was patched in version 1.9.4.
tgstation-server is a tool for managing BYOND servers that may have an issue with the DreamMaker API chat channel cache. After a restart and reattach of tgstation-server, the cache can be poisoned, leading to chat messages being sent to configured IRC or Discord channels.
CVE-2023-34204 affects imapsync versions up to 2.229, which uses predictable paths in the /tmp and /var/tmp directories. These directories are typically world-writable, allowing an attacker to modify imapsync's cache and overwrite user files.
The WooCommerce Follow-Up Emails (AutomateWoo) plugin versions <= 4.9.40 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of a logged-in user.
The ThemeinProgress WIP Custom Login plugin versions <= 1.2.9 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated user.