CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Teleport versions v3.2.2, v3.5.6-rc6, and v3.6.3-b2 were found to have an information leak through the /user/get-role-list web interface. The vulnerability allows unauthorized users to access the list of roles.
A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /calendar/viewcalendar.php. This flaw allows an attacker to inject arbitrary web scripts or HTML via the Subject field.
A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /forums/editforum.php. It allows an attacker to inject arbitrary web scripts or HTML via the Name field.
A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /general/search.php?searchtype=simple. Attackers can inject arbitrary web scripts or HTML via a crafted payload in the Search field.
A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /meetings/listmeetings.php. Attackers can inject arbitrary web scripts or HTML via the Name field, leading to script execution in the victim's browser.
A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /clients/listclients.php. Attackers can inject arbitrary JavaScript or HTML into the Name field, leading to script execution in the victim's browser.
A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /projects/listprojects.php. Attackers can inject arbitrary web scripts or HTML via the Name field, leading to script execution in the victim's browser.
A cross-site scripting (XSS) vulnerability was discovered in the Chat function of webtareas 2.4p5. This flaw allows attackers to inject arbitrary web scripts or HTML via the Messages field.
A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the /contacts/listcontacts.php component. Attackers can inject arbitrary web scripts or HTML via the Last Name field when adding a contact.
A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /linkedcontent/listfiles.php. Attackers can inject arbitrary web scripts or HTML into the Name field after clicking 'Add'.
Rukovoditel v3.2.1 was found to have a stored cross-site scripting (XSS) vulnerability in the application configuration module. An attacker can inject malicious JavaScript or HTML into the Copyright Text field, which executes upon saving.
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.php?module=entities/forms&entities_id=24. Attackers can inject malicious JavaScript or HTML into the Name field, leading to arbitrary script execution in victims' browsers.
Rukovoditel v3.2.1 was found to have a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. Attackers can inject malicious JavaScript or HTML into the Name field, leading to script execution in other users' browsers.
Rukovoditel v3.2.1 contains a stored XSS vulnerability in the Add New Field function. Attackers can inject malicious JavaScript or HTML into the Short Name field, leading to script execution in other users' browsers.
Rukovoditel v3.2.1 was found to have a stored cross-site scripting (XSS) vulnerability in the Entities Group feature. Attackers can inject malicious JavaScript or HTML into the Name field, leading to script execution in other users' browsers.
Rukovoditel v3.2.1 contains a stored cross-site scripting (XSS) vulnerability in the Highlight Row feature. An attacker can inject malicious JavaScript or HTML into the Note field, leading to script execution in the victim's browser.
Rukovoditel v3.2.1 was found to have a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module=help_pages/pages&entities_id=24. Attackers can inject arbitrary JavaScript or HTML into the Title field, which will be executed in other users' browsers.
Rukovoditel v3.2.1 was found to have a stored cross-site scripting (XSS) vulnerability in the Add Announcement function. Attackers can inject arbitrary JavaScript or HTML into the Title field, leading to script execution in other users' browsers.
Jeecg-boot version 3.4.3 was found to contain a SQL injection vulnerability in the /sys/user/deleteRecycleBin component. An attacker can exploit this flaw to manipulate database queries.
Jeecg-boot version 3.4.3 was found to contain a SQL injection vulnerability in the /sys/user/putRecycleBin component. An attacker can exploit this flaw to execute unauthorized database queries.