CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /linkedcontent/listfiles.php. Attackers can inject arbitrary web scripts or HTML into the Name field after clicking 'Add'.
Rukovoditel v3.2.1 was found to have a stored cross-site scripting (XSS) vulnerability in the application configuration module. An attacker can inject malicious JavaScript or HTML into the Copyright Text field, which executes upon saving.
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.php?module=entities/forms&entities_id=24. Attackers can inject malicious JavaScript or HTML into the Name field, leading to arbitrary script execution in victims' browsers.
Rukovoditel v3.2.1 was found to have a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. Attackers can inject malicious JavaScript or HTML into the Name field, leading to script execution in other users' browsers.
Rukovoditel v3.2.1 contains a stored XSS vulnerability in the Add New Field function. Attackers can inject malicious JavaScript or HTML into the Short Name field, leading to script execution in other users' browsers.
Rukovoditel v3.2.1 was found to have a stored cross-site scripting (XSS) vulnerability in the Entities Group feature. Attackers can inject malicious JavaScript or HTML into the Name field, leading to script execution in other users' browsers.
Rukovoditel v3.2.1 contains a stored cross-site scripting (XSS) vulnerability in the Highlight Row feature. An attacker can inject malicious JavaScript or HTML into the Note field, leading to script execution in the victim's browser.
Rukovoditel v3.2.1 was found to have a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module=help_pages/pages&entities_id=24. Attackers can inject arbitrary JavaScript or HTML into the Title field, which will be executed in other users' browsers.
Rukovoditel v3.2.1 was found to have a stored cross-site scripting (XSS) vulnerability in the Add Announcement function. Attackers can inject arbitrary JavaScript or HTML into the Title field, leading to script execution in other users' browsers.
Jeecg-boot version 3.4.3 was found to contain a SQL injection vulnerability in the /sys/user/deleteRecycleBin component. An attacker can exploit this flaw to manipulate database queries.
Jeecg-boot version 3.4.3 was found to contain a SQL injection vulnerability in the /sys/user/putRecycleBin component. An attacker can exploit this flaw to execute unauthorized database queries.
Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability in the /sys/dict/queryTableData component. An attacker can exploit this flaw to execute unauthorized database queries.
The Amasty Blog Pro plugin versions 2.10.3 and 2.10.4 for Magento 2 contain a Stored Cross-site Scripting (XSS) vulnerability due to the duplicate post function.
Amasty Blog version 2.10.3 is vulnerable to Cross-Site Scripting (XSS) via the leave comment functionality. This allows an attacker to inject malicious JavaScript code into the page.
A broken access control vulnerability was found in Maarch RM 2.8.3. When previewing documents (PDF, email) from an archive, the application generates a URL containing an MD5 hash of the file, which is accessible without authentication.
An authenticated SQL Injection vulnerability in the statistics page (/statistics/retrieve) of Maarch RM 2.8, via the filter parameter, allows the complete disclosure of all databases.
Multiple vulnerabilities in the SMB2 processor of the Snort detection engine on various Cisco products could allow an unauthenticated, remote attacker to bypass configured policies or cause a denial of service (DoS) condition on an affected device.
In Liferay Portal and DXP, the Test LDAP Users functionality exposes LDAP credentials in the page URL when paginating through the user list. Man-in-the-middle attackers or those with access to request logs can capture these credentials.
Liferay products are missing SSL certificate validation in the Dynamic Data Mapping module's REST data providers. This affects Liferay Portal 7.1.0 through 7.4.2 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3.
The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, and 7.4 GA does not properly check permission of form entries, which allows remote authenticated users to view and access all form entries.