CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability was found in wallabag 2.5.4 related to an unknown functionality of the file /config of the Profile Config component. Manipulation of the argument Name leads to resource allocation.
A vulnerability was found in GZ Multi Hotel Booking System 1.8 that allows cross site scripting (XSS) attacks through manipulation of the adults/children/cal_id arguments in the /index.php file.
A vulnerability was found in GZ E Learning Platform version 1.8, affecting some unknown processing of the URL Parameter Handler component. Manipulation of this component leads to cross site scripting attacks.
A vulnerability has been found in GZ Scripts PHP CRM Platform 1.8 affecting unknown code in the /index.php file. Manipulation of the 'action' argument leads to cross site scripting.
A vulnerability classified as problematic was found in GZ Scripts PHP GZ Hotel Booking Script version 1.8. Manipulation of the arguments first_name, second_name, phone, address_1, and country leads to cross-site scripting attacks.
A vulnerability has been identified in GZ Scripts Ticket Booking Script version 1.8 that allows cross site scripting (XSS) attacks through manipulation of the arguments first_name, second_name, phone, address_1, and country in the /load.php file.
A vulnerability was found in GZ Scripts PHP GZ Appointment Scheduling Script version 1.8 that allows cross-site scripting (XSS) attacks by manipulating the arguments first_name, second_name, phone, address_1, and country in the /load.php file.
A vulnerability has been identified in GZ Scripts Event Booking Calendar version 1.8 that allows cross-site scripting (XSS) attacks through manipulation of the first_name, second_name, phone, address_1, and country arguments in the /load.php file.
A vulnerability was found in GZ Scripts Property Listing Script version 1.0, rated as problematic. The issue affects some unknown processing of the file /preview.php, where manipulation of the argument page/layout/sort_by leads to cross-site scripting.
A vulnerability was found in GZ Scripts Car Listing Script PHP version 1.8, affecting unknown code in the /preview.php file. Manipulation of the page/sort_by argument leads to cross-site scripting.
A vulnerability was found in GZ Scripts PHP Vacation Rental Script version 1.8, classified as problematic. Manipulation of the argument page/layout/sort_by/property_id leads to cross-site scripting.
A vulnerability was found in GZ Forum Script 1.8 that allows cross-site scripting (XSS) attacks through manipulation of arguments in the /preview.php file.
The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
A vulnerability in Apache Camel allows unauthorized exposure of sensitive information. It affects versions from 3.X to 3.14.8, 3.18.X to 3.18.7, 3.20.X to 3.20.5, and 4.X to 4.0.0-M3.
In the Winter content management system, prior to version 1.2.3, users with the `backend.manage_branding` permission could upload SVG files as application logos without sanitization, potentially leading to XSS attacks. Version 1.2.3 introduces fixes that provide full support for SVG uploads and automatic sanitization of these files.
A vulnerability was found in GZ Scripts Time Slot Booking Calendar PHP version 1.8, allowing cross-site scripting (XSS) attacks through manipulation of the arguments first_name, second_name, phone, address_1, and country in the /load.php file.
A vulnerability was found in GZ Scripts Availability Booking Calendar PHP 1.8, classified as problematic. It affects an unknown part of the file load.php of the HTTP POST Request Handler, leading to cross-site scripting attacks.
The Tekton Pipelines project does not validate child UIDs in version 0.35.0 and later, allowing users with access to create TaskRuns to create their own Tasks that the Pipelines controller accepts as child Tasks.
A vulnerability was found in ThinuTech ThinuCMS version 1.5 that allows cross site scripting (XSS) attacks through manipulation of arguments in the /contact.php file.
A vulnerability has been found in ThinuTech ThinuCMS version 1.5 that allows cross-site scripting (XSS) attacks through manipulation of the 'author' argument in the /author_posts.php file. Injecting malicious scripts can lead to unauthorized code execution in users' browsers.