CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product with administrative privileges.
A cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and prior to 5.2.3L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user using the product.
A critical vulnerability was found in jeecgboot JimuReport up to version 1.6.0, related to an unknown functionality of the Template Handler component. Manipulation of this functionality leads to injection.
A critical vulnerability was found in SourceCodester Free and Open Source Inventory Management System version 1.0. Manipulation of the argument columns[0][data] in the file /index.php?page=member leads to SQL injection.
A critical vulnerability was found in OpenRapid RapidCMS version 1.3.1, affecting unknown processing of the file admin/run-movepass.php. Manipulation of the arguments password/password2 leads to weak password recovery.
A critical vulnerability has been found in OpenRapid RapidCMS version 1.3.1, affecting unknown code in the file admin/article-chat.php. Manipulation of the argument id leads to SQL injection.
A critical vulnerability was found in OpenRapid RapidCMS version 1.3.1, affecting an unknown part of the file template/default/category.php. Manipulation of the argument id leads to SQL injection.
A critical vulnerability has been found in Mini-Tmall up to version 20230811, affecting some unknown functionality of the file product/1/1?test=1&test2=2&. Manipulation of the argument orderBy leads to SQL injection.
A critical vulnerability was found in SourceCodester Free Hospital Management System for Small Practices 1.0. Manipulation of arguments in the file vm\patient\edit-user.php leads to SQL injection.
A critical vulnerability has been found in SourceCodester Free Hospital Management System for Small Practices. Manipulation of arguments in the file vm\doctor\edit-doc.php leads to SQL injection.
A critical SQL injection vulnerability was found in Free Hospital Management System for Small Practices 1.0 in the file booking-complete.php. An attacker can remotely manipulate the userid, apponum, or scheduleid parameters, leading to SQL injection.
A critical vulnerability was found in SourceCodester Free Hospital Management System for Small Practices version 1.0. Manipulation of the 'sheduledate' argument in the /patient/appointment.php file leads to SQL injection.
A critical vulnerability was found in SourceCodester Free Hospital Management System for Small Practices 1.0. Manipulation of the 'sheduledate' argument in the appointment.php file leads to SQL injection.
A vulnerability was found in SourceCodester Card Holder Management System 1.0 affecting an unknown functionality of the Minus Value Handler component. The manipulation leads to improper validation of specified quantity in input.
A critical vulnerability has been identified in SourceCodester Inventory Management System version 1.0. Manipulation of the 'customer' argument in the app/ajax/search_sales_report.php file leads to SQL injection, allowing for remote attacks.
A critical vulnerability was found in SourceCodester Inventory Management System version 1.0. Manipulation of the 'customer' argument in the file app/ajax/search_sell_paymen_report.php leads to SQL injection, allowing for remote attacks.
A critical vulnerability has been found in SourceCodester Inventory Management System 1.0, affecting some unknown processing of the file app/action/edit_update.php. Manipulation of the argument user_id leads to SQL injection.
An issue was discovered in MediaWiki before version 1.35.11 and in versions 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1 that allows bypassing the Bad image list (badFile) using the thumb parameter (Manualthumb) of the File syntax.
A Cross-site Scripting (XSS) reflected vulnerability exists in the GitHub repository cockpit-hq/cockpit prior to version 2.6.4.
Improper Input Validation in GitHub repository hamza417/inure prior to build88.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS