CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability has been found in Boom CMS version 8.0.7 affecting the add function of the assets-manager component. Manipulation of the title/description arguments leads to cross site scripting attacks.
A vulnerability was found in PaulPrinting CMS 2018 that allows cross site scripting (XSS) attacks by manipulating the argument 's' in the /account/delivery file of the Search component. The attack can be executed remotely.
A vulnerability has been found in ActiveITzone Active Super Shop CMS 2.5 that allows cross site scripting (XSS) attacks through manipulation of the arguments name, phone, and address on the Manage Details Page. The attack can be initiated remotely.
A vulnerability was found in Codecanyon Tiva Events Calender 1.4 that allows cross site scripting attacks through manipulation of the argument name. The attack can be initiated remotely.
A vulnerability was found in PaulPrinting CMS 2018, rated as problematic. Manipulation of the arguments firstname/lastname/address/city/state leads to cross-site scripting attacks.
A vulnerability was found in Dooblou WiFi File Explorer version 1.13.3 that leads to cross-site scripting (XSS) attacks through manipulation of the search, order, download, or mode arguments. The attack can be launched remotely.
A vulnerability was found in Webile 1.0.1, classified as problematic. It affects an unknown function of the HTTP POST Request Handler component, where manipulation of the argument new_file_name/c leads to cross site scripting.
In HashiCorp Nomad Enterprise versions 1.2.11 to 1.5.6 and 1.4.10, ACL policies using a block without a label generate unexpected results. This issue is fixed in versions 1.6.0, 1.5.7, and 1.4.11.
A flaw was found in the Keylime attestation verifier, which fails to flag a device as untrusted when the TPM quote's signature does not validate. Instead, it only logs an error.
A vulnerability was found in Intergard SGS 8.7.0 affecting unknown code of the SQL Query Handler component. The manipulation leads to cleartext transmission of sensitive information.
A vulnerability was found in Intergard SGS 8.7.0, affecting some unknown functionality of the Password Change Handler component. Manipulation leads to cleartext transmission of sensitive information.
A vulnerability has been identified in GZ Scripts Car Rental Script version 1.8 that allows cross site scripting (XSS) attacks through manipulation of arguments in the /EventBookingCalendar/load.php file. An attacker can remotely exploit this vulnerability by injecting malicious data into the first_name, second_name, phone, address_1, and country fields.
A vulnerability was found in Creativeitem Atlas Business Directory Listing version 2.13, allowing cross-site scripting (XSS) attacks through manipulation of the search_string argument in the /home/search file.
A vulnerability has been found in Creativeitem Atlas Business Directory Listing version 2.13, allowing cross site scripting attacks through manipulation of the price-range argument in the /home/filter_listings file.
A vulnerability was identified in Creativeitem Ekushey Project Manager CRM 5.0 that allows cross site scripting attacks through manipulation of the message argument in the file /index.php/client/message/message_read/xxxxxxxx[random-msg-hash].
A vulnerability has been found in Creativeitem Mastery LMS version 1.2 that allows cross site scripting attacks through manipulation of an argument in the /browse file. The attack can be initiated remotely.
A vulnerability was found in Creativeitem Academy LMS 5.15, rated as problematic. Manipulation of the sort_by argument in the /home/courses file leads to cross-site scripting attacks.
Fides is an open-source privacy engineering platform that is vulnerable to a Denial of Service (DoS) attack. Attackers can exploit this vulnerability to upload malicious SVG files, leading to resource exhaustion in Admin UI browser tabs.
Fides is an open-source privacy engineering platform that is vulnerable to a Denial of Service (DoS) attack through the upload of a malicious zip bomb file. Versions of Fides from `2.11.0` to `2.15.1` are affected by this vulnerability, which requires elevated privileges to exploit.
The Mattermost WelcomeBot plugin fails to validate membership status when inviting or adding users to channels, allowing guest accounts to be added by default.