CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability was found in Cute Http File Server 2.0, classified as problematic. It affects an unknown part of the search component and leads to cross site scripting attacks.
A vulnerability has been found in PHP Jabbers Availability Booking Calendar version 5.0, allowing cross site scripting attacks through manipulation of the session_id argument in the /index.php file.
The BluetensQ app version 4.3.15 for Bluetens electrostimulation device is vulnerable to man-in-the-middle attacks over BLE. Attackers can hijack BLE communication to decrease or increase stimulation intensity.
CVE-2023-4016 allows a user with access to run the 'ps' utility on a machine to write almost unlimited amounts of unfiltered data into the process heap.
Uninitialized buffer in GBL parser in Silicon Labs GSDK v4.3.0 and earlier allows attacker to leak data from Secure stack via malformed GBL file.
Discourse is an open source discussion platform, where prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, more users than permitted could be created from invite links. The issue is patched in versions 3.0.6 and 3.1.0.beta7.
A vulnerability has been found in Mingsoft MCMS up to version 5.3.1 that allows cross site scripting attacks through manipulation of the 'style' argument in the search.do file. The attack can be initiated remotely.
A vulnerability was found in SourceCodester Jewelry Store System 1.0, rated as problematic. It affects some unknown functionality of the file add_customer.php, leading to cross-site scripting attacks.
A vulnerability was found in SourceCodester Simple Online Mens Salon Management System 1.0 that allows cross-site scripting (XSS) attacks by manipulating the First Name/Last Name/Username arguments in the /admin/?page=user/list file.
In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane allows high-privileged users to create Packages referencing arbitrarily large images. This could lead to exhausting available memory and result in the container being OOMKilled.
A vulnerability was found in GZ Scripts Availability Booking Calendar PHP 1.0 that allows cross site scripting (XSS) attacks through manipulation of the img argument in the file /index.php?controller=GzUser&action=edit&id=1. The attack can be initiated remotely.
A vulnerability has been found in GZ Scripts Availability Booking Calendar PHP 1.0 that allows cross site scripting (XSS) attacks through manipulation of the promo_code argument in the index.php file. The attack can be launched remotely.
The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject passive HTML.
The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'vczapi_encrypt_decrypt' function in versions up to, and including, 4.2.1. This allows unauthenticated attackers to decrypt and view the meeting id and password.
A vulnerability was found in phpscriptpoint Lawyer 1.6, classified as problematic. It affects an unknown part of the file search.php and leads to cross site scripting.
TYPO3 is a PHP-based content management system that had a vulnerability in versions from 9.4.0 to 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, and 12.4.4, allowing out-of-scope access to content in multi-site scenarios. This enabled visitors to access internal site content by manipulating HTTP query parameters in the URL.
A vulnerability was found in phpscriptpoint Lawyer 1.6, affecting some unknown functionality of the file page.php. The manipulation leads to cross site scripting (XSS) attacks that can be launched remotely.
A vulnerability has been found in Campcodes Beauty Salon Management System 1.0 that allows cross site scripting via manipulation of the id argument in the /admin/edit-accepted-appointment.php file. The attack can be initiated remotely.
A vulnerability was found in Campcodes Beauty Salon Management System 1.0 that allows cross-site scripting (XSS) attacks through manipulation of the adminname argument in the /admin/admin-profile.php file.
A vulnerability was found in Campcodes Beauty Salon Management System 1.0 that allows cross site scripting (XSS) attacks through manipulation of the searchdata argument in the /admin/search-appointment.php file. The attack can be launched remotely.