CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The jose library, used for cryptographic operations, has a vulnerability in the AES_CBC_HMAC_SHA2 algorithm that allows the use of a padding oracle to decrypt data without knowing the key. Observable timing differences during padding errors can enable an attacker to exploit this vulnerability.
Froala Editor 3.2.6 is vulnerable to persistent XSS. A crafted base64 string in the hyperlink creation module allows injection of malicious scripts.
In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c.
SeedDMS 5.1.x is affected by a cross-site request forgery (CSRF) vulnerability in out.EditFolder.php. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated user.
SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditDocument.php. An attacker can exploit this vulnerability to perform unauthorized actions on behalf of a victim.
Multiple stored cross-site scripting (XSS) vulnerabilities in openMAINT 2.1-3.3-b allow remote attackers to inject arbitrary web script or HTML via any "Add" sections, such as Add Card Building & Floor, or others in the Name and Code Parameters.
A stored cross-site scripting (XSS) vulnerability in Maxum Rumpus 8.2.13 and 8.2.14 allows attackers to inject malicious scripts via folder names. Insufficient input validation leads to persistent script storage on the server.
A reflected cross-site scripting (XSS) vulnerability exists in qcubed (all versions including 3.1.1) in profile.php via the stQuery parameter. It allows unauthenticated attackers to steal sessions of authenticated users.
An issue was discovered in app/Model/SharingGroupServer.php in MISP 2.4.139, where the implementation of Sharing Groups sometimes provided view access to unintended actors via the 'all org' flag.
Yeastar NeoGate TG400 devices running firmware version 91.3.0.3 are affected by a directory traversal vulnerability. An authenticated user can decrypt the firmware and read sensitive information, such as passwords or decryption keys.
W urządzeniach PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 oraz PM800 występuje podatność typu CWE-352: Cross-Site Request Forgery. Może to spowodować, że użytkownik wykona niezamierzoną akcję na docelowym urządzeniu podczas korzystania z interfejsu webowego HTTP.
Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS) in /usr/local/nagiosxi/html/admin/sshterm.php due to improper input sanitization. A crafted URL can steal admin session cookies or be chained with other bugs for one-click RCE.
CASAP Automated Enrollment System 1.0 is vulnerable to cross-site scripting (XSS) in users.php. An attacker can steal a user's session cookie and redirect them to a malicious website.
A stored XSS vulnerability was found in BDTASK Multi-Store Inventory Management System 1.0. A local admin can inject arbitrary JavaScript code via the Customer Name field.
A cross-site scripting (XSS) vulnerability exists in the Add Patient Form of QDOCS Smart Hospital Management System 3.1. A remote attacker can inject arbitrary JavaScript code via fields such as Name, Guardian Name, Email, Address, Remarks, or Any Known Allergies.
Textpattern 4.8.4 is affected by cross-site scripting (XSS) in the Body parameter, allowing an attacker to inject malicious scripts. This can lead to session theft or user redirection.
A cross-site scripting (XSS) vulnerability exists in MISP v2.4.128 in the SetHomePage() function in app/Controller/UserSettingsController.php. Due to a lack of controller validation in the 'path' parameter, an attacker can execute malicious JavaScript code.
Serwer API Kubernetes we wszystkich wersjach pozwala atakującemu, który potrafi stworzyć usługę ClusterIP i ustawić pole spec.externalIPs, na przechwycenie ruchu do tego adresu IP. Dodatkowo, atakujący, który ma możliwość modyfikacji statusu usługi LoadBalancer, może ustawić status.loadBalancer.ingress.ip w podobny sposób.
A vulnerability in the STM32 cryptographic firmware library (UM1924) allows a Bleichenbacher attack on PKCS #1 v1.5 padding for RSA. An attacker can remotely decrypt encrypted ciphertext by making successive queries to the server using the vulnerable library.
The Stockdio Historical Chart plugin for WordPress before version 2.8.1 is vulnerable to Cross-Site Scripting (XSS). The stockdio_eventer function listens for postMessage events without validating the origin, allowing an attacker to execute arbitrary JavaScript in the victim's browser.