CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A cross-site scripting (XSS) vulnerability was found in Online Fire Reporting System v1.0 in /index.php/?p=report. Attackers can inject malicious JavaScript or HTML via the "Contac #" text field.
Cross Site Scripting (XSS) vulnerability in Gollum versions 5.0 through 5.1.2. The attack is possible via the filename parameter in the 'New Page' dialog.
A stored XSS vulnerability was found in osTicket-plugins Storage-FS before commit a7842d494889fd5533d13deb3c6a7789768795ae in the audit/class.audit.php component. Attackers can execute arbitrary web scripts or HTML via a crafted SVG file.
A cross-site scripting (XSS) vulnerability was discovered in the Mediacenter by EGT-Kommunikationstechnik UG before version 2.0, specifically in the Online_Update.php component. It allows injection of malicious scripts into the page.
Magnolia CMS v6.2.19 contains a cross-site scripting (XSS) vulnerability in the Edit Contact function. An attacker can inject arbitrary JavaScript or HTML by uploading a crafted SVG document as a profile picture.
A vulnerability in iTop VPN 3.2 allows an attacker to steal another user's token by creating a named pipe with the same name used by the iTopVPNmini.exe component. The attacker listens for connections and abuses the ImpersonateNamedPipeClient() function.
IObit products (Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, iTop Screenshot) use unencrypted HTTP connections to download configuration files during updates. An attacker can intercept this traffic and supply a malicious config file pointing to fake update locations, leading to remote code execution with administrative privileges.
A stored cross-site scripting (XSS) vulnerability in the Add Classification function of Zoo Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via unspecified vectors.
SourceCodester Zoo Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the msg parameter in the register_visitor script. An attacker can inject malicious JavaScript code that will be executed in the victim's browser.
A stored cross-site scripting (XSS) vulnerability in LightCMS v1.3.11 allows attackers to execute arbitrary web scripts or HTML via uploading a crafted PDF file.
A Cross Site Scripting (XSS) vulnerability has been discovered in Ruckus Wireless ZoneDirector version 9.8.3.0. It allows a remote attacker to inject malicious scripts into the management interface.
Persistent XSS in Galaxkey Secure Mail Client up to version 5.6.11.5 allows an attacker to intercept an HTTP POST request when sending an email and inject a crafted XSS payload in the 'subject' field, which executes when the recipient logs into their mailbox.
Missing access control in the backup system of Telesoft VitalPBX before version 3.2.1 allows attackers to access PJSIP and SIP extension credentials, cryptographic keys, and voicemail files via unspecified vectors.
Unioncms version 1.0.13 contains a stored XSS vulnerability in the Default settings. An attacker can inject a malicious script that will be executed in the administrator's browser.
ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cross Site Scripting (XSS), allowing injection of malicious scripts.
PEEL Shopping CMS 9.4.0 is vulnerable to authenticated SQL injection in utilisateurs.php. An authenticated administrator can inject a malicious SQL query, affecting application logic and retrieving database information.
In Connx version 6.2.0.1269 (20210623), the application may issue a cookie without the Secure flag set. This means the cookie can be transmitted over unencrypted HTTP connections.
In Connx version 6.2.0.1269 (20210623), a cookie can be issued by the application without the HttpOnly flag set. The absence of this flag allows potential client-side script access to the cookie.
A cross-site scripting (XSS) vulnerability exists in Mini CMS V1.11. The vulnerability is located on the post-edit.php page during article upload.
ACEweb Online Portal 3.5.065 was found to have a cross-site scripting (XSS) vulnerability via the txtNmName1 parameter in person.awp. An attacker can inject malicious JavaScript code that executes in the victim's browser.