CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An issue was discovered in app/Model/SharingGroupServer.php in MISP 2.4.139, where the implementation of Sharing Groups sometimes provided view access to unintended actors via the 'all org' flag.
Yeastar NeoGate TG400 devices running firmware version 91.3.0.3 are affected by a directory traversal vulnerability. An authenticated user can decrypt the firmware and read sensitive information, such as passwords or decryption keys.
W urządzeniach PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 oraz PM800 występuje podatność typu CWE-352: Cross-Site Request Forgery. Może to spowodować, że użytkownik wykona niezamierzoną akcję na docelowym urządzeniu podczas korzystania z interfejsu webowego HTTP.
Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS) in /usr/local/nagiosxi/html/admin/sshterm.php due to improper input sanitization. A crafted URL can steal admin session cookies or be chained with other bugs for one-click RCE.
CASAP Automated Enrollment System 1.0 is vulnerable to cross-site scripting (XSS) in users.php. An attacker can steal a user's session cookie and redirect them to a malicious website.
A stored XSS vulnerability was found in BDTASK Multi-Store Inventory Management System 1.0. A local admin can inject arbitrary JavaScript code via the Customer Name field.
A cross-site scripting (XSS) vulnerability exists in the Add Patient Form of QDOCS Smart Hospital Management System 3.1. A remote attacker can inject arbitrary JavaScript code via fields such as Name, Guardian Name, Email, Address, Remarks, or Any Known Allergies.
Textpattern 4.8.4 is affected by cross-site scripting (XSS) in the Body parameter, allowing an attacker to inject malicious scripts. This can lead to session theft or user redirection.
A cross-site scripting (XSS) vulnerability exists in MISP v2.4.128 in the SetHomePage() function in app/Controller/UserSettingsController.php. Due to a lack of controller validation in the 'path' parameter, an attacker can execute malicious JavaScript code.
Serwer API Kubernetes we wszystkich wersjach pozwala atakującemu, który potrafi stworzyć usługę ClusterIP i ustawić pole spec.externalIPs, na przechwycenie ruchu do tego adresu IP. Dodatkowo, atakujący, który ma możliwość modyfikacji statusu usługi LoadBalancer, może ustawić status.loadBalancer.ingress.ip w podobny sposób.
A vulnerability in the STM32 cryptographic firmware library (UM1924) allows a Bleichenbacher attack on PKCS #1 v1.5 padding for RSA. An attacker can remotely decrypt encrypted ciphertext by making successive queries to the server using the vulnerable library.
The Stockdio Historical Chart plugin for WordPress before version 2.8.1 is vulnerable to Cross-Site Scripting (XSS). The stockdio_eventer function listens for postMessage events without validating the origin, allowing an attacker to execute arbitrary JavaScript in the victim's browser.
MISP version 2.4.136 has an XSS vulnerability that can be exploited via a crafted URL to the user homepage favourite button in app/View/Elements/global_menu.ctp.
MISP version 2.4.136 has an XSS vulnerability via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs.
MISP version 2.4.136 has a Stored XSS vulnerability in the galaxy cluster view that can be exploited via a cluster name in app/View/GalaxyClusters/view.ctp.
A Bleichenbacher vulnerability in the PKCS #1 v1.5 padding implementation for RSA in Microchip Libraries for Applications (versions up to 2018-11-26) allows an attacker to decrypt encrypted ciphertext by making successive queries to the server, resulting in remote information disclosure.
Cross Site Scripting (XSS) vulnerability in Digisol DG-HR3400 router. The flaw exists in the Time and Date module (NTP server name field) and URL Filter (Keyword field).
A Cross Site Scripting (XSS) vulnerability in the Beetel router 777VR1 can be exploited via the NTP server name in System Time and the "Keyword" field in URL Filter.
Atakujący może wysłać specjalnie przygotowaną wiadomość do Crimson 3.1 (wersje kompilacji przed 3119.001), co może prowadzić do wycieku dowolnych lokalizacji pamięci.
EGavilanMedia User Registration and Login System With Admin Panel 1.0 is vulnerable to cross-site scripting (XSS) in the Admin Profile Page. An attacker can inject a malicious JavaScript payload into the 'Admin Full Name' field, which triggers every time the admin visits the profile page.