CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.19)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Frappe is a full-stack web application framework. Prior to versions 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email.
A vulnerability in SourceCodester Photo Share Website 1.0 affects an unknown part of the file /social/ajax.php?action=save_upload of the Comment Input Box component. Manipulation of the content argument leads to cross site scripting. The attack may be initiated remotely, and the exploit is publicly available.
File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files. When the file to be rotated is a symbolic link to a missing file, and the touch option is enabled, the rotate method assumes that the file is absent and does not rotate it, but touches the file, which creates the target. An attacker who can create the symlink can use this to create an arbitrary file with permissions of the process rotating the files.
A cross-site scripting vulnerability was found in SourceCodester Photo Share Website 1.0 in an unknown function of the file /social/index.php?page=home. Manipulation of the Comment argument causes XSS. The attack can be initiated remotely and the exploit is public.
A vulnerability was detected in WonderTrader up to 0.9.9 in the function TraderDD::queryTrades of src/TraderDD/TraderDD.cpp. Manipulation of the FID_JYLB argument results in enforcement of behavioral workflow. The attack can be launched remotely but is difficult to exploit. The exploit is public and the vendor did not respond.
A cross-site scripting vulnerability was found in PHPGurukul Company Visitor Management System 1.0 in the file /manage-newvisitors.php. Manipulation of the fullname argument leads to XSS. The attack can be initiated remotely and the exploit is public.
An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.
The root password hash of the device can be obtained through unencrypted information in the firmware.
Mermaid before 10.9.8 and 11.16.1 is vulnerable to prototype pollution via configuration setters when untrusted data is passed. Diagram-supplied config is not affected.
Traefik from 3.6.11 to 3.6.25 and 3.7.10 has a vulnerability in BasicAuth middleware allowing an attacker with valid credentials and hash to authenticate as an unconfigured username.
GitHub CLI before 2.97.0 fails to escape regex metacharacters in --signer-repo and --signer-workflow, allowing attackers to bypass Sigstore attestation verification with lookalike names.
GitHub CLI before 2.97.0 masks only part of certain tokens in gh auth status, potentially exposing token fragments in terminal or CI output.
OpenReception before 1.0.6 has a weak proof-of-work (16 bits) in the bootstrap-challenge endpoint, allowing easy bypass of rate limiting and automated abuse of booking flow.
OpenReception before 1.0.6 has a vulnerability in staff deletion by TENANT_ADMIN that removes invites in other tenants sharing the same email.
Integer overflow in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
DataGear up to 5.0.0 has an XSS vulnerability in HtmlTplDashboardWidgetHtmlRenderer where the Title argument is mishandled, allowing remote script execution.
InstaKNXServiceApp 1.2.3.1469 has a vulnerability in CreateWebClientAndDownloadFileList that insufficiently verifies data authenticity during firmware updates, potentially allowing remote attacks.
A path traversal vulnerability was found in FoundationAgents MetaGPT up to version 0.8.2, affecting the read function in metagpt/tools/libs/editor.py. The attack requires local access. The exploit has been publicly disclosed and may be used. The vendor did not respond to the disclosure.