CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Adobe Commerce is affected by an Improper Input Validation vulnerability that could lead to a security feature bypass. A high-privileged attacker can gain unauthorized write access, requiring user interaction such as visiting a malicious URL.
Aplikacja nie wprowadza wystarczających ograniczeń dotyczących uprawnień dostępu do katalogów, co stwarza ryzyko, że inne złośliwe aplikacje mogą uzyskać dostęp do wrażliwych informacji.
CRLF Injection vulnerability in cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields. The cow_cookie:cookie/1 function builds a Cookie header without validation, allowing an attacker to inject ;, ,, CR, LF, or TAB characters.
A cross-site scripting vulnerability was identified in Devs Palace ERP Online up to version 4.0.0 in the file /accounts/chart-save. The attack can be performed remotely and the exploit is publicly available.
In WebAssembly Binaryen up to version 117, the function IRBuilder::makeBrOn in src/wasm/wasm-ir-builder.cpp has a reachable assertion. Manipulation of input can cause a crash. The exploit is publicly available.
A cross-site scripting vulnerability was detected in Devs Palace ERP Online up to version 4.0.0 in the file /accounts/mr-save. The attack can be launched remotely and the exploit is publicly available.
A cross-site scripting vulnerability was found in Devs Palace ERP Online up to version 4.0.0 in the file /inventory/add_new_customer. The attack can be initiated remotely and the exploit is publicly available.
A cross-site scripting vulnerability was found in Devs Palace ERP Online up to version 4.0.0 in the /inventory/sales_save file. Remote attack is possible. Exploit is publicly available. The vendor did not respond.
A cross-site scripting vulnerability was identified in Devs Palace ERP Online up to version 4.0.0 in the file /inventory/purchase_save. The attack can be initiated remotely and the exploit is publicly available.
A vulnerability was found in Canias ERP 8.03 in the doAction function of the Login RMI Interface component. Manipulation results in observable response discrepancy, allowing remote attack with high complexity. The exploit has been made public.
In libexpat before version 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.
In Dotouch XproUPF version 2.0.0-release-088aa7c4, the function vlib_worker_loop in the library /usr/xpro/upf/tools/libs/libvlib.so (UPF Process component) can be manipulated, leading to denial of service.
A cross-site scripting vulnerability was found in Devs Palace ERP Online up to version 4.0.0 in the file /inventory/item-save. The attack can be carried out remotely and the exploit is publicly available.
A cross-site scripting vulnerability was detected in Devs Palace ERP Online up to version 4.0.0 in the file /inventory/customer-save. The attack can be executed remotely and the exploit is publicly available.
In Devs Palace ERP Online up to version 4.0.0, an unknown function in the file /inventory/supplier-save is vulnerable to Cross Site Scripting (XSS). The attack can be performed remotely, and the exploit has been publicly disclosed. The vendor did not respond to the disclosure.
Devs Palace ERP Online up to version 4.0.0 is vulnerable to Cross-Site Scripting (XSS) in an unknown function of the file /inventory/purchase_return_save. The attack can be launched remotely and the exploit is public.
Vulnerability in GrapheneOS before 2026050400. Attackers can discover the real IP address of a VPN user due to a registerQuicConnectionClosePayload optimization, when 'Block connections without VPN' and 'Always-on VPN' settings are enabled. An application can let system_server transmit UDP traffic on its behalf.
JeecgBoot 3.9.1 has an authorization bypass vulnerability in the mLogin endpoint. The attack can be carried out remotely but is considered difficult to exploit.
In SysReptor before version 2026.29, users with "User Admin" permissions can change email addresses of "Superuser" users. If "Forgot Password" is enabled, they can reset the superuser's password and access the Django backend and manipulate settings.
FastGPT before version 4.14.17 has an unauthenticated SSRF vulnerability. The fetchData function does not validate URLs against an internal blocklist, allowing requests to internal/private addresses.