CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.11)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A cross-site scripting (XSS) vulnerability was found in LimeSurvey 3.6.2+180406 in the theme.php controller. Attackers can inject arbitrary web script or HTML via the changes_cp parameter in requests to the index.php/admin/themes/sa/templatesavechanges URI.
A Cross Site Scripting (XSS) vulnerability exists in the redirect module of Racktables version 0.21.2. An attacker can inject arbitrary web script or HTML via the op parameter.
An issue was discovered in Mahavitaran android application 7.50 and below, allowing local attackers to read cleartext username and password while the user is logged into the application.
Chamilo LMS version 1.11.14 is affected by a Cross Site Scripting (XSS) vulnerability in /plugin/jcapture/applet.php. An attacker can exploit this by passing a hex2bin encoded message in the cookie.
An IDOR vulnerability in ICREM H8 SSRMS allows unauthorized access to sensitive information via the Print Invoice Functionality. Attackers can exploit this flaw to read data without proper permissions.
All versions of GitLab CE/EE before 14.2.6, versions from 14.3 to 14.3.4, and versions from 14.4 to 14.4.1 accidentally log the system root password in migration logs. This allows an attacker with local file system access to obtain root-level privileges.
CVE-2021-39904 describes an improper access control vulnerability in the GraphQL API in all versions of GitLab CE/EE from 13.1 to 14.2.6, from 14.3 to 14.3.4, and from 14.4 to 14.4.1. This allows a Merge Request creator to resolve discussions and apply suggestions after a project owner has locked the Merge Request.
An XSS vulnerability in Pandora FMS up to version 755 allows an attacker to inject malicious script by creating a new event filter with a crafted name.
A vulnerability in Artica Pandora FMS up to version 755 allows an admin to overwrite the .htaccess file via the File Manager component. The new .htaccess contains a Rewrite Rule with a file type definition, enabling upload of a normal PHP file and code execution via an HTTP request.
An issue was discovered in SpotAuditor 5.3.5 where entering 300 bytes of character data into the 'Key' or 'Name' field during registration can crash the program.
A Cross Site Scripting (XSS) vulnerability was found in DynPG 4.9.1. An authenticated attacker can execute arbitrary JavaScript code via the groupname parameter.
AVideo/YouPHPTube 10.0 and prior versions are affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities via the videoName parameter. This allows a remote attacker to steal administrator session cookies or perform actions as an administrator.
AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross-Site Scripting (XSS) vulnerabilities via the 'u' parameter. A remote attacker can exploit this to steal administrator session cookies or perform actions as an administrator.
AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross-Site Scripting (XSS) vulnerabilities via the searchPhrase parameter. This allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.
Several web interfaces on the D-Link DIR-868LW router version 1.12b lack authentication requirements, allowing attackers to access users' DNS query history.
A vulnerability in the IKEv2 implementation of Cisco ASA and FTD Software could allow an authenticated, remote attacker to trigger a denial of service (DoS) condition. This is due to improper resource control. An attacker who can spoof a trusted IKEv2 site-to-site VPN peer and has valid credentials could send malformed, authenticated IKEv2 messages, causing a device reload.
A vulnerability in the Snort detection engine of multiple Cisco products when processing ICMP traffic could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The issue is due to improper memory resource management while processing ICMP packets. An attacker could send a series of ICMP packets through an affected device, potentially exhausting resources and causing a reload.
A vulnerability in the SNMPv3 access control functionality of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to query SNMP data. This is due to ineffective access control. An attacker could send an SNMPv3 query from a host not permitted by the ACL and retrieve information if valid credentials are held.
Multiple vulnerabilities in the Application Level Gateway (ALG) for the Network Address Translation (NAT) feature of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the ALG and open unauthorized connections with a host behind the ALG. These vulnerabilities are publicly known as NAT Slipstreaming.
Multiple vulnerabilities in the Application Level Gateway (ALG) for the Network Address Translation (NAT) feature of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the ALG and open unauthorized connections with a host behind the ALG. These vulnerabilities are publicly known as NAT Slipstreaming.