CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An issue was discovered in MISP before version 2.4.158 related to stored XSS in the event graph via a tag name.
An issue was discovered in MISP before version 2.4.158 related to stored XSS in galaxy clusters.
An issue was discovered in MISP before version 2.4.158 related to stored XSS in the LinOTP login field.
Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13 and 7.3 fix pack 2 do not properly check user permission when accessing a list of sites/groups. This allows remote authenticated users to view sites/groups via the user's site membership assignment UI.
Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector in Liferay Portal 7.3.3 through 7.4.0, and Liferay DXP 7.3 before Service Pack 3. Remote attackers can inject arbitrary web script or HTML via the name of an asset category.
Multiple XSS vulnerabilities were found in Liferay Portal 7.3.5 through 7.4.0 and Liferay DXP 7.3 before service pack 3. An attacker can inject arbitrary script or HTML via form field help text in the Forms module or App Builder module.
An issue in EasyIO CPT Graphics v0.8 allows attackers to discover valid users in the application. This vulnerability enables unauthorized user enumeration.
A Directory Traversal vulnerability in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0. An attacker can exploit the 'page' parameter in index.php to read arbitrary files on the server.
A Cross Site Scripting (XSS) vulnerability exists in the Exrick XMall Admin Panel in product-add.jsp. An attacker can inject a malicious script via the GET parameter, leading to JavaScript execution in the victim's browser.
The Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to transmitting write requests and characters, which may allow an attacker to manipulate device data or functions.
A Cross Site Scripting (XSS) vulnerability was found in Chikista Patient Management Software 2.0.2 in the first_name parameter. It affects the following pages: patient/insert, patient_report, appointment_report, visit_report, and bill_detail_report.
Online Banking System Protect v1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via parameters on user profile, system_info and accounts management.
In Totolink A3100R firmware version V5.9c.4577, the test.asp file exposes an unauthenticated API-like function. This allows an attacker to modify multiple device settings without any authentication.
A stored cross-site scripting (XSS) vulnerability in Hospital Patient Record Management System v1.0 allows attackers to inject malicious scripts or HTML via the 'special' field.
CheckMK Raw Edition versions 1.5.0 to 1.6.0 do not sanitize input of a web service parameter in an unauthenticated zone. This Reflected XSS allows an attacker to open a backdoor with HTML content interpreted by the browser (e.g., JavaScript) or steal session cookies of an authenticated user via man-in-the-middle.
Joget DX 7 was discovered to contain a cross-site scripting (XSS) vulnerability via the Datalist table. An attacker can inject a malicious script that will be executed in the victim's browser.
The vulnerability in SurveyKing v0.2.0 retains users' session cookies after logout. An attacker can use the browser cache to log in to the system and access data when the user exits the application.
Yonyou u8 v13.0 was found to contain a DOM-based cross-site scripting (XSS) vulnerability via the /u8sl/WebHelp component. An attacker can inject a malicious script that executes in the victim's browser.
A stored cross-site scripting (XSS) vulnerability in the upload function of /admin/show.php allows attackers to execute arbitrary web scripts or HTML via a crafted image file.
A cross-site scripting (XSS) vulnerability was discovered in BigAnt Server version 5.6.06. It allows an attacker to inject malicious scripts into web pages.