CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The vulnerability in Mealie 1.0.0beta3 fails to terminate download tokens after a user logs out, allowing attackers to perform a man-in-the-middle attack via a crafted GET request.
An XSS (Cross-Site Scripting) vulnerability was discovered in rageframe2 version 2.6.37. The flaw exists in user agent related parameters on the info.php page.
Authenticated stored cross-site scripting (XSS) vulnerability in the "Field Server Address" field of INTELBRAS ATA 200 firmware version 74.19.10.21 allows attackers to inject JavaScript code through a crafted payload.
A Storage XSS vulnerability was discovered in EyouCMS version 1.5.8, allowing an attacker to execute arbitrary web scripts or HTML by injecting a special payload via the title parameter in the frontend contribution form.
A vulnerability in Simcenter STAR-CCM+ exposes user, host, and display names when the Power-on-Demand public license server is used. An attacker can remotely retrieve this information.
A Cross-site scripting (XSS) vulnerability in the JSON search parse and response in eShop - Multipurpose Ecommerce Store Website version 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the get_products?search parameter.
Wykryto podatność typu Denial-of-Service w produktach F-Secure Atlant oraz niektórych produktach WithSecure, która może prowadzić do awarii silnika skanującego podczas analizy zniekształconych plików PE32-bit. Atakujący może zdalnie wywołać ten błąd.
In Moodle before versions 3.8.2, 3.7.5, 3.6.9, and 3.5.11, users viewing the grade history report without the 'access all groups' capability were not restricted to viewing grades of users within their own groups.
PyroCMS version 3.9 was found to contain multiple cross-site scripting (XSS) vulnerabilities.
An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned based on usernames.
Niewystarczające egzekwowanie polityki w DevTools w Google Chrome na systemie Windows przed wersją 103.0.5060.53 umożliwia atakującemu, który przekonał użytkownika do zainstalowania złośliwego rozszerzenia, uzyskanie potencjalnie wrażliwych informacji z lokalnych plików użytkownika za pomocą spreparowanej strony HTML.
A cross-site scripting (XSS) vulnerability was found in Online Fire Reporting System v1.0 in /index.php/?p=report. Attackers can inject malicious JavaScript or HTML via the "Contac #" text field.
Cross Site Scripting (XSS) vulnerability in Gollum versions 5.0 through 5.1.2. The attack is possible via the filename parameter in the 'New Page' dialog.
A stored XSS vulnerability was found in osTicket-plugins Storage-FS before commit a7842d494889fd5533d13deb3c6a7789768795ae in the audit/class.audit.php component. Attackers can execute arbitrary web scripts or HTML via a crafted SVG file.
A cross-site scripting (XSS) vulnerability was discovered in the Mediacenter by EGT-Kommunikationstechnik UG before version 2.0, specifically in the Online_Update.php component. It allows injection of malicious scripts into the page.
Magnolia CMS v6.2.19 contains a cross-site scripting (XSS) vulnerability in the Edit Contact function. An attacker can inject arbitrary JavaScript or HTML by uploading a crafted SVG document as a profile picture.
A vulnerability in iTop VPN 3.2 allows an attacker to steal another user's token by creating a named pipe with the same name used by the iTopVPNmini.exe component. The attacker listens for connections and abuses the ImpersonateNamedPipeClient() function.
IObit products (Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, iTop Screenshot) use unencrypted HTTP connections to download configuration files during updates. An attacker can intercept this traffic and supply a malicious config file pointing to fake update locations, leading to remote code execution with administrative privileges.
A stored cross-site scripting (XSS) vulnerability in the Add Classification function of Zoo Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via unspecified vectors.
SourceCodester Zoo Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the msg parameter in the register_visitor script. An attacker can inject malicious JavaScript code that will be executed in the victim's browser.