CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A cross-site scripting (XSS) vulnerability was found in the search function of S-CMS Government Station Building System v5.0. It allows injection of malicious JavaScript code into the page.
Wersje Apache Log4j2 od 2.0-alpha1 do 2.16.0 (z wyjątkiem 2.12.3 i 2.3.1) nie chroniły przed niekontrolowaną rekurencją w przypadku samoodwołujących się wyszukiwań. Umożliwia to atakującemu, który ma kontrolę nad danymi w Thread Context Map, spowodowanie odmowy usługi podczas interpretacji spreparowanego ciągu.
Verint Workforce Optimization (WFO) version 15.2.8.10048 is vulnerable to Cross-Site Scripting (XSS) via the NEWUINAV parameter in the control/my_notifications endpoint. An attacker can inject malicious JavaScript code that executes in the victim's browser.
A cross-site scripting (XSS) vulnerability was found in Genesys Workforce Management 8.5.214.20 during record deletion via the Time-off parameter. An attacker can inject a malicious script that executes in the victim's browser.
A cross-site scripting (XSS) vulnerability was found in LimeSurvey 3.6.2+180406 in the theme.php controller. Attackers can inject arbitrary web script or HTML via the changes_cp parameter in requests to the index.php/admin/themes/sa/templatesavechanges URI.
A Cross Site Scripting (XSS) vulnerability exists in the redirect module of Racktables version 0.21.2. An attacker can inject arbitrary web script or HTML via the op parameter.
An issue was discovered in Mahavitaran android application 7.50 and below, allowing local attackers to read cleartext username and password while the user is logged into the application.
Chamilo LMS version 1.11.14 is affected by a Cross Site Scripting (XSS) vulnerability in /plugin/jcapture/applet.php. An attacker can exploit this by passing a hex2bin encoded message in the cookie.
An IDOR vulnerability in ICREM H8 SSRMS allows unauthorized access to sensitive information via the Print Invoice Functionality. Attackers can exploit this flaw to read data without proper permissions.
All versions of GitLab CE/EE before 14.2.6, versions from 14.3 to 14.3.4, and versions from 14.4 to 14.4.1 accidentally log the system root password in migration logs. This allows an attacker with local file system access to obtain root-level privileges.
CVE-2021-39904 describes an improper access control vulnerability in the GraphQL API in all versions of GitLab CE/EE from 13.1 to 14.2.6, from 14.3 to 14.3.4, and from 14.4 to 14.4.1. This allows a Merge Request creator to resolve discussions and apply suggestions after a project owner has locked the Merge Request.
An XSS vulnerability in Pandora FMS up to version 755 allows an attacker to inject malicious script by creating a new event filter with a crafted name.
A vulnerability in Artica Pandora FMS up to version 755 allows an admin to overwrite the .htaccess file via the File Manager component. The new .htaccess contains a Rewrite Rule with a file type definition, enabling upload of a normal PHP file and code execution via an HTTP request.
An issue was discovered in SpotAuditor 5.3.5 where entering 300 bytes of character data into the 'Key' or 'Name' field during registration can crash the program.
A Cross Site Scripting (XSS) vulnerability was found in DynPG 4.9.1. An authenticated attacker can execute arbitrary JavaScript code via the groupname parameter.
AVideo/YouPHPTube 10.0 and prior versions are affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities via the videoName parameter. This allows a remote attacker to steal administrator session cookies or perform actions as an administrator.
AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross-Site Scripting (XSS) vulnerabilities via the 'u' parameter. A remote attacker can exploit this to steal administrator session cookies or perform actions as an administrator.
AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross-Site Scripting (XSS) vulnerabilities via the searchPhrase parameter. This allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.
Several web interfaces on the D-Link DIR-868LW router version 1.12b lack authentication requirements, allowing attackers to access users' DNS query history.
In Oracle PeopleSoft Enterprise CS Campus Community (Notification Framework) versions 9.0 and 9.2, a low-privileged attacker with physical access to the communication segment can gain unauthorized access to critical data or all accessible data.