CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A cross-site scripting (XSS) vulnerability in ApolloTheme AP PageBuilder component through version 2.4.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the show_number parameter.
Relative path traversal vulnerability in Eclipse GlassFish versions 5.1.0 to 6.2.5. Unauthenticated remote attacker can access configuration files and application source code. Fixed in GlassFish 7.0.0.
In MISP versions up to 2.4.167, there is an XSS vulnerability in app/View/AuthKeys/authkey_display.ctp that can be exploited via the Referer field when adding an authkey.
In MISP version 2.4.167, there is an XSS vulnerability that allows an attack via a network history name in the app/webroot/js/action_table.js file.
Multiple XSS vulnerabilities were found in ReQlogic version 11.3. An attacker can inject malicious JavaScript or HTML via the POBatch and WaitDuration parameters.
CRLF vulnerability in the Reprise License Manager (RLM) web interface through version 14.2BL4 in the password parameter of the View License Result function allows remote attackers to inject arbitrary HTTP headers.
An SSRF vulnerability was discovered in the Reprise License Manager (RLM) web interface up to version 14.2BL4. It allows remote attackers to send requests to internal servers and perform port scans via the actserver parameter in the License Activation function.
An OS Command Injection vulnerability was found in OKER G955V1 firmware version v1.03.02.20161128. A physical attacker can interrupt the boot sequence and execute arbitrary commands with root privileges.
Wykorzystanie uszkodzonego lub ryzykownego algorytmu kryptograficznego w funkcji mbedtls_mpi_exp_mod() w pliku lignum.c w Mbed TLS we wszystkich wersjach przed 3.0.0, 2.27.0 lub 2.16.11 umożliwia atakującym, posiadającym dostęp do wystarczająco precyzyjnych informacji o czasie i dostępie do pamięci, odzyskanie kluczy prywatnych używanych w RSA.
A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. Recommended upgrade to Kernel 6.2 or apply relevant stable backports.
An XSS vulnerability in Typora through version 1.3.8 allows an attacker to inject malicious JavaScript via a document containing an SVG element with an attacker-controlled onload attribute. When the exported document is opened by a victim, the code executes in the context of their browser.
In MISP before version 2.4.167, there is an XSS vulnerability in the template file uploads in app/View/Templates/upload_file.ctp.
A cross-site scripting (XSS) vulnerability in NdkAdvancedCustomizationFields v3.5.0 allows attackers to execute arbitrary web scripts or HTML via crafted payloads injected into the 'htmlNodes' parameter.
Employee Performance Evaluation System v1.0 was found to have a persistent cross-site scripting (XSS) vulnerability in the Departments and Designations module. An attacker can inject malicious scripts when adding new entries.
W optee_os w TrustedFirmware Open Portable Trusted Execution Environment (OP-TEE) przed wersją 3.20 występuje niechroniona operacja dostępu do pamięci, która pozwala fizycznie bliskiemu przeciwnikowi na ominięcie weryfikacji podpisu i zainstalowanie złośliwych aplikacji zaufanych za pomocą wstrzyknięć zakłóceń elektromagnetycznych.
Adobe Campaign version 7.3.1 (and earlier) and 8.3.9 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.
W Mbed TLS przed wersją 2.28.2 oraz 3.x przed wersją 3.3.0 odkryto problem, który pozwala atakującemu na odzyskanie prywatnego klucza RSA po zaobserwowaniu jednego działania z użyciem klucza prywatnego. Warunkiem jest, aby rozmiar okna (MBEDTLS_MPI_WINDOW_SIZE) używanego do eksponentacji wynosił 3 lub mniej.
Resque Scheduler version 1.27.4 is vulnerable to Cross-site scripting (XSS). A remote attacker can inject JavaScript code into the "schedule_job" or "args" parameters in the /resque/delayed/jobs/{schedule_job}?args={args_id} endpoint, leading to client-side script execution.
A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. An unauthorized user with access to email and SMS account configuration files could discover SMTP account credentials and the SIM card PIN code.
In PcVue versions 15 through 15.2.2, a vulnerability allows insertion of sensitive information into log files. A user with access to these logs can discover connection strings for data sources configured for DbConnect, which may include credentials.