CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in PHPMyWind 5.6, allowing attackers to create a new administrator account without authentication.
rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may successfully download any file on the server.
An XSS vulnerability in Afian FileRun 2021.03.26 allows an attacker to inject malicious scripts when an administrator uses the HTML Editor to preview or edit a crafted document.
An SSRF vulnerability in NagiosXI up to version 5.8.4 allows authenticated users to create scheduled reports with PDF screenshots of any view. Lack of input sanitization enables replacing the target page with an SSRF payload.
Afian FileRun 2021.03.26 is vulnerable to stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs. An attacker can inject malicious JavaScript code.
JIZHICMS 1.5.1 contains a cross-site scripting (XSS) vulnerability in the /user/release.html component, allowing attackers to arbitrarily add an administrator cookie.
W Kubernetes odkryto problem bezpieczeństwa, który pozwala aktorom kontrolującym odpowiedzi na żądania MutatingWebhookConfiguration lub ValidatingWebhookConfiguration na przekierowanie żądań kube-apiserver do prywatnych sieci apiservera. Użytkownik, który ma dostęp do logów kube-apiserver przy poziomie logowania ustawionym na 10, może zobaczyć przekierowane odpowiedzi i nagłówki w logach.
Podatność CVE-2021-22791 dotyczy błędu zapisu poza granicami (CWE-787) w kontrolerach Modicon PLC, który może prowadzić do awarii usługi podczas aktualizacji aplikacji kontrolera za pomocą specjalnie przygotowanego pliku projektu. Dotyczy to różnych modeli kontrolerów Modicon M580, M340, MC80, Momentum oraz symulatorów PLC.
Podatność CWE-125: Odczyt poza zakresem, która może spowodować Denial of Service na kontrolerze/symulatorze Modicon PLC podczas aktualizacji aplikacji kontrolera za pomocą specjalnie przygotowanego pliku projektu. Dotyczy to różnych modeli kontrolerów Modicon M580, M340, MC80, Momentum oraz symulatorów PLC dla EcoStruxure.
Występuje podatność CWE-119: Niewłaściwe ograniczenie operacji w granicach bufora pamięci, która może spowodować Denial of Service na kontrolerze/symulatorze Modicon PLC podczas aktualizacji aplikacji kontrolera za pomocą specjalnie przygotowanego pliku projektu. Dotyczy to różnych modeli kontrolerów Modicon M580, M340, MC80, Momentum Ethernet, Quantum oraz Premium, a także symulatorów PLC dla EcoStruxure.
WTCMS 1.0 contains a reflective cross-site scripting (XSS) vulnerability in the page management background, allowing attackers to steal cookies via a crafted payload in the search box.
A Cross Site Scripting (XSS) vulnerability was found in TRENDnet TV-IP110WN cameras running firmware versions V1.2.2.64, V1.2.2.65, and V1.2.2.68. The flaw exists in the 'profile' parameter of a GET request to view.cgi.
In MISP version 2.4.147, there is a Stored XSS vulnerability in app/View/GalaxyElements/ajax/index.ctp that can be exploited when viewing galaxy cluster elements in JSON format.
In MISP version 2.4.147, there is a stored XSS vulnerability in the view_relation_tree.ctp file, allowing malicious code execution when viewing galaxy cluster relationships.
In MISP version 2.4.146, there is a Stored XSS vulnerability in app/View/GalaxyClusters/add.ctp that can be exploited when forking a galaxy cluster.
Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitrary web script or HTML via the class_name parameter to update_class.php.
Vulnerability in PeopleSoft Enterprise CS Campus Community product (component: Integration and Interfaces) versions 9.0 and 9.2. Allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data.
A Cross-Site Scripting (XSS) vulnerability was found in PbootCMS version 2.0.3 in the admin.php file. It allows an attacker to inject malicious JavaScript code into the admin panel.
A cross-site request forgery (CSRF) vulnerability was found in XYHCMS V3.6 at the URI /xyhai.php?s=/Auth/editUser. It allows an attacker to modify administrator information, including name, email, and password.
A cross-site scripting (XSS) vulnerability was found in baigo CMS v4.0-beta-1. Attackers can inject arbitrary JavaScript or HTML code via the 'post' parameter sent to /public/console/profile/info-submit/.