CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple cross-site scripting (XSS) vulnerabilities were found in the /obcs/user/profile.php component of Online Birth Certificate System v1.2. Attackers can inject malicious JavaScript or HTML via the fname or lname parameters, leading to arbitrary script execution in the victim's browser.
Diary Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name parameter in search-result.php. This allows an attacker to inject malicious scripts into the page.
A vulnerability in the Z-Wave S0 NonceGet protocol specification in Silicon Labs Z-Wave 500 series allows a local attacker to block S0/S2 protected Z-Wave networks by sending crafted S0 NonceGet packets that exploit included but absent NodeIDs.
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier. A remote unauthenticated attacker can execute arbitrary code via the fileToUpload parameter in the uploadFile task.
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK version 10.11 and earlier. A remote unauthenticated attacker can execute arbitrary code via the searchString parameter in the wikiScrapper task.
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier allows remote unauthenticated attackers to execute arbitrary code via the 'key' parameter in the getESRIExtraConfig task.
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier allows remote unauthenticated attackers to execute arbitrary JavaScript code via the 'key' parameter in the getGoogleExtraConfig task.
Home Owners Collection Management v1 was found to have a reflected XSS vulnerability in the Admin panel via the $_GET['page'] parameter. An attacker can inject malicious script.
Home Owners Collection Management v1 was found to have a reflected XSS vulnerability in the Admin panel via the $_GET['s'] parameter. An attacker can inject malicious script.
A stored XSS vulnerability was found in the Add New Employee form of Sourcecodester Employee Daily Task Management System 1.0. A remote attacker can inject and store arbitrary JavaScript code via the Name field, which executes when the data is viewed.
A directory traversal vulnerability in Bookeen Notea Firmware BK_R_1.0.5_20210608 allows an attacker to obtain sensitive information by manipulating file paths.
In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce page by clicking on a crafted link.
Cyclos 4 PRO version 4.14.7 and earlier does not validate user input in error messages, allowing a remote unauthenticated attacker to execute JavaScript code via an undefined enum constant.
A DOM-based Cross-site Scripting (XSS) vulnerability in the account registration process in Cyclos 4 PRO version 14.7 and earlier. A remote attacker can inject arbitrary web script or HTML via the groupId parameter.
A cross-site scripting (XSS) vulnerability in PHP MySQL Admin Panel Generator v1 allows attackers to inject arbitrary web scripts or HTML via a crafted payload in /edit-db.php.
Cross-site scripting (XSS) vulnerability in the Layout module's Open Graph integration in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the site name.
Cross-site scripting (XSS) vulnerability in the Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8. Remote attackers can inject arbitrary web script or HTML via web content template names.
SCBS Online Sports Venue Reservation System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the fid parameter at booking.php.
An issue was discovered in MISP before version 2.4.158 related to XSS in app/Controller/OrganisationsController.php occurring in a situation with a 'weird single checkbox page.'
An issue was discovered in MISP before version 2.4.158 related to XSS in the cerebrate view. If one administrator inputs a javascript: URL in the URL field and another administrator clicks on it, it may lead to unauthorized script execution.