CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The CRM Perks Contact Form Entries plugin versions <= 1.3.0 has a stored Cross-Site Scripting (XSS) vulnerability for users with contributor+ privileges.
The WP-Matomo Integration (WP-Piwik) plugin versions up to 1.0.27 contain a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will be executed in the victim's browser context.
The Ciprian Popescu YouTube Playlist Player plugin versions up to 4.6.4 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.
The PluginOps MailChimp Subscribe Form plugin versions up to 4.0.9.1 has a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this vulnerability to inject malicious scripts that will be executed in the context of users visiting the site.
The Smart App Banner plugin in versions up to 1.1.2 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.
The BEAR plugin in versions <= 1.1.3.1 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.
CSRF vulnerability in Crocoblock JetFormBuilder plugin versions <= 3.0.6 allows attackers to perform unauthorized actions on behalf of users.
The WooDiscuz – WooCommerce Comments plugin has a stored XSS vulnerability that can be exploited by users with admin privileges. This issue affects versions from n/a to 2.2.9.
Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6.
Omni-notes is a note-taking application for Android that had a path validation vulnerability. This vulnerability allowed malicious applications to copy files from internal storage to external storage, potentially leading to unauthorized data access.
The vulnerability in Rekor allows a malformed entry of type `intoto/v0.0.2` to cause a panic in a thread within the Rekor process. However, the service continues to run, and the client receives a 500 error message.
Craft is a content management system (CMS) for creating custom digital experiences. A cross-site scripting (XSS) vulnerability can be triggered by review volumes. This issue has been fixed in version 4.4.7.
Highlight is an open-source monitoring platform that may record passwords when an HTML password input is switched to `type="text"` via a JavaScript 'Show Password' button. This behavior differs from the expected one that always obfuscates `password` type inputs.
Django-SES is a mail backend for Django that implements support for AWS Simple Email Service. The django_ses library had a flaw in verifying AWS request signatures, allowing users to specify arbitrary public certificates.
An issue was discovered in Papaya Viewer version 1.0.1449 related to the lack of input sanitization. User-supplied DICOM or NIFTI images can be loaded, allowing arbitrary JavaScript code injection into image metadata, which is executed when that metadata is displayed.
Craft is a content management system (CMS) for creating custom digital experiences on the web. A cross-site scripting (XSS) vulnerability has been identified that can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.
A stored cross-site scripting (XSS) vulnerability in TFDi Design smartCARS 3 v0.7.0 and below allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the body of news article.
Version 2.1.2 of the mp4v2 library was discovered to contain a memory leak in the MP4BytesProperty class.
Skycaiji version 2.5.4 is vulnerable to Cross Site Scripting (XSS). Attackers can achieve backend access by deploying malicious JSON data.
In version 5.0.5 of mipjz, there is a stored XSS vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the 'name' parameter in /app/tag/controller/ApiAdminTagCategory.php.