CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Mattermost fails to delete card attachments in Boards, allowing an attacker to access deleted attachments.
Mattermost fails to properly show information in the UI, allowing a system admin to modify a board state. This allows any user with a valid sharing link to join the board with editor access, without the UI showing the updated permissions.
Mattermost fails to properly check the authorization of POST /api/v4/teams when passing a team override scheme ID in the request. This allows an authenticated attacker with knowledge of a Team Override Scheme ID to create a new team with said team override scheme.
Mattermost fails to properly restrict requests to localhost/intranet during the interactive dialog, which could allow an attacker to perform a limited blind SSRF.
IBM Robotic Process Automation versions 21.0.0 through 21.0.7.6 and 23.0.0 through 23.0.6 are vulnerable to client side validation bypass, which could allow invalid changes or values in some fields.
A vulnerability was found in layui up to v2.8.0-rc.16, affecting an unknown part of the HTML Attribute Handler component. Manipulation of the title argument leads to cross-site scripting.
A vulnerability was found in Nesote Inout Search Engine AI Edition 1.1 related to the manipulation of the 'page' argument in the /index.php file, leading to cross-site scripting attacks.
A vulnerability was found in LivelyWorks Articart 2.0.1, affecting some unknown functionality of the file /change-language/de_DE of the Base64 Encoding Handler component. Manipulation of the argument redirectTo leads to open redirect.
A vulnerability has been found in LivelyWorks Articart 2.0.1 that allows cross site scripting attacks through manipulation of the search_term argument in the /items/search file. The attack can be launched remotely.
A vulnerability was found in Campcodes Retro Cellphone Online Store 1.0 that allows cross site scripting (XSS) attacks through manipulation of the 'description' argument in the /admin/modal_add_product.php file. The attack can be initiated remotely.
Discourse is an open source discussion platform that has a vulnerability allowing users to bypass topic title validations when editing topics. The issues involve title length, number of emojis in the title, and blank topic titles.
Auto-GPT is an experimental open-source application that, before version 0.4.3, allowed malicious external resources to trigger misleading messages in the console by using ANSI escape sequences. The issue has been patched in release version 0.4.3.
A vulnerability was found in Campcodes Retro Cellphone Online Store version 1.0, allowing cross site scripting (XSS) attacks through manipulation of the 'un' argument in the /admin/add_user_modal.php file.
A vulnerability has been found in SourceCodester AC Repair and Services System 1.0 that allows cross site scripting (XSS) attacks through manipulation of the firstname/middlename arguments in the file admin/?page=user/manage_user.
An information disclosure issue in Gitlab CE/EE affects all versions from 13.6 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, and all versions from 16.1 prior to 16.1.1. The issue resulted in the Sidekiq log including webhook tokens when the log format was set to 'default'.
Jenkins Oracle Cloud Infrastructure Compute Plugin version 1.0.16 and earlier does not validate SSH host keys when connecting to OCI clouds, enabling man-in-the-middle attacks.
In JetBrains IntelliJ IDEA before version 2023.1.4, the license dialog could be suppressed in certain cases.
In the music service, there is a missing permission check, which could lead to local information disclosure with no additional execution privileges needed.
In the music service, there is a missing permission check, which could lead to local information disclosure with no additional execution privileges needed.
Relative path traversal in the Zoom Client SDK before version 5.15.0 may allow an unauthorized user to enable information disclosure via local access.