CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability classified as problematic has been found in SourceCodester Game Result Matrix System 1.0. Manipulation of the argument del_name in the file /dipam/save-delegates.php leads to cross site scripting.
A vulnerability was found in SourceCodester Online School Fees System 1.0 that allows cross-site scripting (XSS) attacks through manipulation of the doj parameter in the /paysystem/datatable.php file. The attack can be launched remotely.
Flask-AppBuilder is an application development framework that prior to version 4.3.2 had a vulnerability allowing an authenticated attacker with Admin privileges to trigger a database error by adding a special character in the add or edit User forms. This error could expose the entire user row, including the pbkdf2:sha256 hashed password.
A vulnerability was found in SourceCodester Resort Management System 1.0 that leads to cross-site scripting (XSS) attacks through manipulation of the 'page' argument. The attack can be launched remotely.
The vulnerability affects sites with invalid TLS certificates, where the activation-delay in Firefox was missing. A malicious page could exploit this flaw to trick users into clicking in precise locations, potentially bypassing the certificate error.
A vulnerability was found in the PuneethReddyHC online-shopping-system-advanced version 1.0, allowing cross-site scripting (XSS) attacks through manipulation of the 'First name' argument in the addsuppliers.php file. The attack can be initiated remotely.
A vulnerability was found in SourceCodester Resort Reservation System 1.0 that allows cross-site scripting (XSS) attacks through manipulation of the Cottage Number argument on the Manage Room Page.
There is a heap-based buffer overflow vulnerability in the GitHub repository gpac/gpac prior to version 2.2.2.
Cilium, a networking, observability, and security solution, prior to version 1.13.4 had a vulnerability that allowed unintended access to secrets and services across namespaces when Gateway API was enabled. The lack of namespace checks when creating ReferenceGrant allowed attackers to use secrets that should not be visible to them.
A debug function in the lua-resty-json package, up to commit id 3ef9492bd3a44d9e51301d6adc3cd1789c8f534a, contained an out of bounds access bug that could have allowed an attacker to launch a DoS when parsing untrusted input data. It is important to note that this debug function was only used in tests and demos.
A vulnerability was found in OTCMS up to version 6.62 that allows path traversal through manipulation of the url argument in the file /admin/read.php?mudi=announContent.
A vulnerability has been identified in OTCMS versions up to 6.62 that allows path traversal attacks through argument manipulation in the usersNews_deal.php file. Exploiting this vulnerability may lead to unauthorized access to system files.
A vulnerability was found in OTCMS up to version 6.62 that allows path traversal via manipulation of the img argument in the admin/readDeal.php?mudi=readQrCode file.
A vulnerability has been found in UJCMS up to version 6.0.2 in the ZIP Package Handler component, which may lead to information disclosure. Manipulation of the argument dir allows for a remote attack, although the complexity is rather high.
A vulnerability was found in SourceCodester Online School Fees System 1.0 that allows cross site scripting attacks through manipulation of the 'branch' parameter in the /paysystem/branch.php file. The attack can be initiated remotely.
A vulnerability has been identified in JT2Go and Teamcenter Visualization applications that are in versions earlier than specified. The issue involves an out of bounds read past the end of an allocated buffer while parsing a specially crafted CGM file, which could lead to the disclosure of sensitive information.
A vulnerability has been identified in JT2Go and Teamcenter Visualization applications, which contains a null pointer dereference vulnerability while parsing specially crafted CGM files. An attacker could leverage this vulnerability to crash the application, causing a denial of service condition.
A vulnerability was found in SourceCodester Sales Tracker Management System 1.0, rated as problematic. Manipulation of the arguments firstname/middlename/lastname/username in the file /classes/Users.php?f=save leads to cross-site scripting attacks.
A vulnerability was found in SourceCodester Performance Indicator System 1.0 that allows cross site scripting (XSS) attacks through manipulation of the prodname argument in the /admin/addproduct.php file.
A vulnerability was found in SourceCodester Life Insurance Management System 1.0 that allows cross site scripting attacks through manipulation of the nominee_id parameter in the insertNominee.php file. The attack can be launched remotely.