CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A buffer overflow vulnerability was found in Libtiff version 4.0.7. A local attacker can exploit the tiffcp function in tiffcp.c to cause a denial of service (DoS).
A reflected Cross Site Scripting (XSS) vulnerability was found in Intermesh BV Group-Office version 6.6.145. Attackers can exploit the GO_LANGUAGE cookie to escalate privileges and obtain sensitive information.
A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comment Body component.
Critical SQL injection vulnerability in Campcodes Retro Basketball Shoes Online Store 1.0 in file details.php via manipulation of the id argument. The attack can be performed remotely and the exploit is publicly available.
Critical SQL injection vulnerability in Campcodes Retro Basketball Shoes Online Store 1.0 in file contactus1.php via manipulation of the email argument. The attack can be performed remotely and the exploit is publicly available.
Critical SQL injection vulnerability in Campcodes Retro Basketball Shoes Online Store 1.0 in file contactus.php via manipulation of the email argument. The attack can be performed remotely and the exploit is publicly available.
A critical vulnerability was found in Campcodes Retro Basketball Shoes Online Store 1.0 in the file /function/login.php. Manipulation of the email argument leads to SQL injection, allowing remote attack. The exploit has been disclosed publicly.
A critical vulnerability was found in Campcodes Retro Basketball Shoes Online Store 1.0 in the file faqs.php. Manipulation of the id argument leads to SQL injection, allowing remote attack. The exploit has been disclosed publicly.
Auto Dealer Management System v1.0 contains a cross-site scripting (XSS) vulnerability via the name parameter in /classes/SystemSettings.php?f=update_settings. An attacker can inject malicious JavaScript code that will be executed in the victim's browser.
A stored HTML injection vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary code via a crafted payload.
An out-of-bounds read vulnerability exists in libjxl. An attacker can cause an out-of-bounds read in the EXIF handler by using a specially crafted file.
A cross-site scripting (XSS) vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary web scripts or HTML.
Insecure permissions were discovered in BMC firmware version 1.63 for the Supermicro X11SSL-CF HW Rev 1.01 motherboard. This vulnerability could allow unauthorized users to access sensitive system management functions.
Cross-site scripting (XSS) vulnerability in Simple Guestbook Management System 1 allows attackers to inject malicious JavaScript via Name, Referrer, Location, and Comments fields.
A Server-Side Request Forgery (SSRF) vulnerability was discovered in request-baskets up to version 1.2.1 via the /api/baskets/{name} component. Attackers can access network resources and sensitive information by crafting a malicious API request.
Podatność CVE-2023-1060 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w systemie YKM CRM, co pozwala na ataki typu Reflected XSS. Problem ten dotyczy wersji YKM CRM przed 23.03.30.
Podatność CVE-2023-1013 dotyczy niewłaściwej neutralizacji tagów HTML związanych z skryptami w aplikacji Vira-Investing, co umożliwia ataki typu Cross-Site Scripting (XSS). Problem ten występuje w wersjach przed 1.0.84.86.
Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the 'values' parameter at /users/absence?search_month=1. An attacker can exploit this flaw to manipulate database queries.
In Stimulsoft Designer (Desktop) versions 2023.1.5 and 2023.1.4, after decompiling the Stimulsoft.report.dll library, an attacker can decrypt any connection string stored in .mrt files because a static secret is used. This secret is identical across all tested versions and operating systems.
An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications. The problem stems from missing proper access controls.