CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2023-37511 concerns improper App Transport Security (ATS) settings that can lead to insecure loading of web content. If configured incorrectly, applications may be vulnerable to security attacks.
Nextcloud Server provides data storage for the Nextcloud cloud platform. In versions from 24.0.4 to 25.0.8, 26.0.3, and 27.0.0, users could add images inline into text files and download them, even if the folder containing the images did not have download permissions.
Nextcloud Server, an open source cloud platform, has a vulnerability that allows unauthenticated users to send DAV requests revealing the existence of a calendar or address book for a given identifier. The issue affects versions from 25.0.0 to 25.0.8, 26.0.0 to 26.0.3, and 27.0.0 to 27.0.0.
The Notes app in Nextcloud, from version 4.4.0 to 4.8.0, has an issue where HTML file content is rendered in the preview instead of being offered for download.
The user_oidc module, which provides the OIDC connect backend for Nextcloud, has a vulnerability that allows an attacker to impersonate the Nextcloud server if they gain at least read access to a snapshot of the database. The issue exists in versions from 1.0.0 to 1.3.2, and version 1.3.3 contains a patch.
In PHOENIX CONTACT's WP 6xxx series web panels in versions prior to 4.0.10, an authenticated remote attacker with admin privileges can read hardcoded cryptographic keys, allowing the attacker to create valid session cookies.
FFRI yarai products and their OEM versions handle exceptional conditions improperly, which may lead to a denial-of-service (DoS) condition. This affects multiple versions of FFRI yarai and related products.
Dangerzone is software for converting potentially dangerous files into safe PDFs. In versions prior to 0.4.2, if the container is compromised, an attacker may spoof messages in the user's terminal or change the window title.
A vulnerability has been identified in Parasolid and Teamcenter Visualization applications affecting versions prior to specified ones. The issue involves stack exhaustion while parsing a specially crafted X_T file, which could lead to a denial of service condition.
A vulnerability has been identified in Parasolid and Teamcenter Visualization applications, present in versions earlier than specified. The issue involves null pointer dereference while parsing specially crafted X_T files, which could allow an attacker to execute code in the context of the current process.
ImageMagick before 6.9.12-91 allows attackers to cause a denial of service (memory consumption) in Magick::Draw.
Due to missing authentication check in SAP Host Agent - version 7.22, an unauthenticated attacker can set an undocumented parameter to a particular compatibility value and in turn call read functions. This allows the attacker to gather some non-sensitive information about the server.
A vulnerability was found in EmpowerID up to version 7.205.0.0 related to the Multi-Factor Authentication Code Handler, leading to information disclosure. The attack complexity is high and exploitation is known to be difficult.
A vulnerability was found in mooSocial mooTravel version 3.1.8, classified as problematic. The manipulation leads to cross site scripting.
A vulnerability has been found in mooSocial mooStore version 3.1.6, leading to cross site scripting attacks. An attacker can remotely manipulate an unknown functionality of the application.
A vulnerability was found in mooSocial mooStore version 3.1.6 that allows cross site scripting (XSS) attacks through manipulation of the argument q in the /search/index file.
A vulnerability was found in DedeBIZ 6.2.10, rated as problematic. It affects some unknown functionality of the Article Handler component and leads to cross site scripting attacks.
A vulnerability was found in Media Browser Emby Server 4.7.13.0, leading to cross site scripting attacks. The issue affects some unknown processing of the file /web/ and may be exploited remotely.
In versions prior to 1.0.1, matrix-appservice-irc allowed crafting an event that could leak part of a message from another bridged room. This required knowing the event ID to target.
A missing Brute-Force protection in CODESYS Development System prior to version 3.5.19.20 allows a local attacker to have unlimited attempts of guessing the password within an import dialog.