CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A stored cross-site scripting (XSS) vulnerability exists in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3. Remote attackers can inject arbitrary web script or HTML via a user's name.
A cross-site scripting (XSS) vulnerability was discovered in SourceCodester Simple Task Managing System v1.0 in the newProjectValidation.php component. Attackers can inject arbitrary web scripts or HTML via the shortName parameter.
A cross-site scripting (XSS) vulnerability was discovered in SourceCodester Simple Task Managing System v1.0 in the newProjectValidation.php file. Attackers can inject arbitrary web scripts or HTML via the fullName parameter.
A cross-site scripting (XSS) vulnerability was discovered in SourceCodester Simple Task Managing System v1.0 via the newTask.php component. Attackers can inject arbitrary web scripts or HTML through the shortName parameter.
Craft CMS version 4.2.0.1 is vulnerable to Cross-Site Scripting (XSS) via the Drafts feature. An attacker can inject a malicious script that will be executed in the victim's browser.
XSS vulnerability in Genesys PureConnect Interaction Web Tools Chat Service (up to at least 26 September 2019) allows injection of malicious script via the JSON parameter 'participant -> name' in the Printable Chat History feature.
Syncovery 9 for Linux version 9.47x and below contains a cross-site scripting (XSS) vulnerability. This flaw could allow an attacker to inject malicious scripts into the user interface.
Qsmart Next v4.1.2 was discovered to contain a cross-site scripting (XSS) vulnerability. This allows an attacker to inject malicious JavaScript code into the web page.
An issue in MSI Feature Navigator v1.0.1808.0901 allows attackers to download arbitrary files from the system, regardless of file type or size.
A Path Traversal vulnerability in SmartVista Cardgen v3.28.0 allows authenticated attackers to read arbitrary files on the system.
A vulnerability in the PlexTrac platform prior to version 1.28.0 allows username enumeration via HTTP response time differences on invalid login attempts for accounts configured with the PlexTrac authentication provider. An unauthenticated remote attacker can identify valid, unlocked user accounts.
CVE-2022-36083 affects JWE key management algorithms based on PBKDF2, which can be exploited to perform brute-force attacks by manipulating the `p2c` parameter. If misconfigured, an attacker can force disproportionate CPU resource consumption during JWE decryption.
In Kirby 2.5.12, a CSRF vulnerability was found in the delete page functionality. A remote attacker can craft a malicious CSRF page and force the user to delete a page.
The vulnerability allows an authenticated user to read sensitive session data stored in cleartext in the OAuth database. The affected device does not encrypt this information.
A flaw was found in AMQ Broker that can lead to partial interruption of system availability due to an Out of Memory (OOM) condition. An attacker can partially disrupt availability to the broker through a sustained attack of maliciously crafted messages.
In Apache ActiveMQ Artemis prior to version 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an address or queue.
An unauthenticated attacker can cause a Denial of Service (DoS) on the D-Link DSL-3782 router by sending a crafted HTTP request. The vulnerability exists in firmware version v1.01.
Frappe ERPNext version 12.29.0 is vulnerable to XSS attacks. The software does not neutralize or incorrectly neutralizes user-controllable input before placing it in output used as a web page served to other users.
Multiple reflected XSS vulnerabilities were found in BPC SmartVista version 3.28.0. These flaws occur when handling error messages, allowing an attacker to execute JavaScript code on the client side.
A buffer overflow vulnerability was discovered in the Tenda AC9 router firmware version V15.03.2.13 in the httpd process. The issue occurs in the form_fast_setting_wifi_set function, potentially allowing remote code execution.