CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vim is an open source command line text editor. A floating point exception may occur when calculating the line offset for overlong lines and smooth scrolling is enabled with the cpo-settings including the 'n' flag. This issue leads to application crashes.
Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure.
In versions of sudo-rs prior to 0.2.1, an issue was discovered where usernames containing '.' and '/' characters could lead to corruption of specific files on the filesystem. A user with such a name could delete a binary file, resulting in its removal from the system.
A vulnerability was found in Dreamer CMS up to version 4.1.3 that allows remote access to files or directories through manipulation of the file /upload/ueditorConfig?action=config. It is classified as problematic with a high complexity of attack.
A vulnerability has been found in TOTVS RM 12.1 that allows cross site scripting attacks through manipulation of the VIEWSTATE argument in the Login.aspx file. The attack can be executed remotely, but its complexity is high.
An issue was discovered in the default implementations of the `VolatileMemory` trait functions in a typical Virtual Machine Monitor (VMM), which may lead to out-of-bounds memory access. This affects users of custom `VolatileMemory` implementations that do not adhere to the `get_slice` documentation.
A vulnerability was found in Infosoftbd Clcknshop 1.0.0, leading to cross site scripting (XSS) attacks through manipulation of the argument q in the file /collection/all. The attack can be initiated remotely.
Graylog, a log management platform, uses a single source port for DNS queries, which goes against recommended security practices. This could allow DNS cache poisoning attacks, where an external attacker can inject forged DNS responses into Graylog's cache.
Graylog has a partial path traversal vulnerability in the `Support Bundle` feature that allows an attacker with valid Admin role credentials to download or delete files in sibling directories. The issue is caused by improper input validation in an HTTP API resource.
IBM Security Verify Information Queue versions 10.0.4 and 10.0.5 stores sensitive information in plain clear text, which can be read by a local user.
In the GitHub repository instantsoft/icms2 prior to version 2.16.1, there is a vulnerability related to a sensitive cookie in an HTTPS session that lacks the 'Secure' attribute.
In the Graylog platform, in multi-node clusters, a user session may still be used for API requests after logout until it reaches its original expiry time. Each node maintains a local cache of user sessions, leading to situations where other nodes may still accept the session after it has been removed from the local cache.
xrdp is an open source remote desktop protocol (RDP) server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions.
There is a Server-Side Request Forgery (SSRF) vulnerability in the GitHub repository bookstackapp/bookstack prior to version 23.08. This allows attackers to send requests to internal server services, potentially leading to the exposure of sensitive information.
A vulnerability has been identified in SourceCodester Inventory Management System version 1.0 that allows cross site scripting (XSS) attacks through manipulation of the name/company argument in the suppliar_data.php file. The attack can be launched remotely.
A vulnerability was found in SPA-Cart eCommerce CMS version 1.9.0.3, rated as problematic. Manipulation of the arguments filter[brandid] and filter[price] in the /search file leads to cross-site scripting attacks.
A vulnerability was found in Byzoro Smart S85F Management Platform up to version 20230816, concerning an unknown functionality of the file /sysmanage/licence.php. Manipulation of this functionality leads to improper access controls.
A vulnerability was found in the NeoMind Fusion Platform up to version 20230731, allowing cross site scripting (XSS) attacks through manipulation of the link argument in the /fusion/portal/action/Link file. The attack can be executed remotely.
In JetBrains TeamCity versions before 2023.05.3, reflected XSS was possible during user registration.
In the password recovery form of Silverware Games, the response time varies depending on whether the specified email address exists in the database. This issue has been fixed in version 1.3.7.