CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Cross Site Scripting (XSS) vulnerability in AfterShip Tracking versions up to 1.18.1, exploitable by a user with Subscriber role.
Broken Access Control vulnerability in AI for SEO versions up to 2.4.2, exploitable without authentication.
Cross Site Scripting (XSS) vulnerability in Profile Extra Fields by BestWebSoft versions up to 1.3.4, exploitable by a user with Subscriber role.
Broken Access Control vulnerability in ReactPress versions up to 3.4.0, exploitable by a user with Subscriber role.
Broken Access Control vulnerability in WP Social Avatar versions up to 1.5, exploitable without authentication.
Sensitive Data Exposure vulnerability in Payment Forms for Paystack versions up to 4.0.5, exploitable by a user with Subscriber role.
Broken Access Control vulnerability in Secure Card Gateway for ePay Paycenter (Piraeus Bank) versions up to 1.0.32, exploitable without authentication.
Cross Site Scripting (XSS) vulnerability in AcyMailing SMTP Newsletter versions up to 10.11.1, exploitable by a user with Subscriber role.
Broken Access Control vulnerability in AcyMailing SMTP Newsletter up to version 10.11.1 allows a subscriber to gain unauthorized access to administrative functions.
Sensitive data exposure vulnerability in WP Event Solution up to version 4.1.18 allows unauthorized access to customer data.
Broken Access Control vulnerability in Service Finder Booking up to version 6.2 allows a subscriber to gain unauthorized access to administrative functions.
Unauthenticated Insecure Direct Object References (IDOR) vulnerability in Do Lasso up to version 358 allows an unauthenticated attacker to access objects without authorization.
Broken Access Control vulnerability in Tourfic up to version 2.23.1 allows a subscriber to gain unauthorized access to administrative functions.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Popup by Supsystic up to version 1.11.2 allows an unauthenticated attacker to inject malicious scripts.
HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may be displayed to users, potentially resulting in unintended behavior or security impact under certain conditions.
Stored Cross-site Scripting (XSS) vulnerability in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML() before interpolating it into the onclick attribute of the account deletion button, but the browser HTML-decodes attribute values before the JavaScript engine parses the handler, allowing an encoded single quote (') to break out of the string literal and inject arbitrary JavaScript that executes when the victim clicks the delete button for that account.
HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted without adequate rate limiting or challenge mechanisms, potentially resulting in unintended behavior or security impact under certain conditions.
A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during script execution in a privileged context. This can lead to the overwrite of root-owned files, potentially disrupting system services or operation. Exploitation is conditional on the script running with elevated privileges and may be mitigated by sticky-directory symlink protections.
A race condition flaw was found in sblim-sfcb during privileged instance migration. A local low-privileged attacker can manipulate a temporary file in /tmp by repeatedly recreating a symbolic link, redirecting privileged output to an arbitrary file. This can lead to privileged file corruption or denial of service.
An unsafe deserialization vulnerability was found in sblim-sfcb's provider-manager IPC message parsing. A local attacker can send a crafted message causing out-of-bounds memory access, leading to termination of the provider-manager process and denial of service. This could also potentially result in limited unintended information disclosure.