CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.19)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Missing authentication for a critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.
Deserialization of untrusted data vulnerability in Microsoft Office SharePoint. An unauthenticated attacker can remotely execute code on the SharePoint server.
The Balbooa Forms extension for Joomla versions below 2.4.1 contains a vulnerability allowing an unauthenticated attacker to upload arbitrary files, including executable files. This leads to full remote code execution (RCE).
A Path Traversal vulnerability in ColdFusion versions 2025.9, 2023.20 and earlier allows a remote attacker to execute arbitrary code in the context of the current user without requiring user interaction. The issue stems from improper limitation of a pathname to a restricted directory.
The Page Builder CK extension for Joomla versions below 3.6.0 contains a vulnerability allowing an unauthenticated attacker to upload arbitrary files, including executable files. This leads to full remote code execution (RCE).
In Langflow prior to 1.9.1, an IDOR vulnerability in the /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.
A vulnerability in the iCagenda extension for Joomla allows arbitrary file upload in the file attachment feature, leading to PHP code upload and execution.
A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
A critical remote code execution (RCE) vulnerability in PTC Windchill PDMlink and PTC FlexPLM. The flaw can be exploited via deserialization of untrusted data, allowing an attacker to execute arbitrary code remotely.
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager allows an authenticated remote attacker to create or overwrite any file on the filesystem. This is due to improper input validation during file upload.
The LiteSpeed cPanel plugin before version 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS. This vulnerability was exploited in the wild in May 2026.
SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. Identity tokens submitted during login are accepted without verifying their cryptographic signature, allowing a remote, unauthenticated attacker to obtain a fully authenticated technician session.
A vulnerability in Oracle PeopleSoft Enterprise PeopleTools (component: Updates Environment Management). Affects versions 8.61 and 8.62. Easily exploitable, allows an unauthenticated attacker via HTTP to take over PeopleSoft Enterprise PeopleTools.
In Splunk Enterprise 10.2 before 10.2.4 and 10.x before 10.0.7, an unauthenticated user can create or truncate arbitrary files via a PostgreSQL sidecar service endpoint. The endpoint lacks authentication.
An OS command injection vulnerability in Fortinet FortiSandbox (versions 5.0.0-5.0.5, 4.4.0-4.4.8, 4.2 all, FortiSandbox Cloud 5.0.4-5.0.5, FortiSandbox PaaS 5.0.4-5.0.5). An unauthenticated attacker can execute unauthorized commands via crafted HTTP requests.
An OS Command Injection vulnerability in Ivanti Sentry before versions R10.5.2, R10.6.2 and R10.7.1. A remote unauthenticated user can achieve root-level remote code execution.
An out-of-bounds read and write vulnerability in the V8 engine in Google Chrome prior to 149.0.7827.103 allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High.
A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange. An unauthenticated attacker can bypass user authentication and establish a VPN connection without a valid password.
On affected platforms running Arista EOS, a tunnel decapsulation configuration, such as VXLAN, decap-groups, or a GRE tunnel interface, may lead to incorrect decapsulation and forwarding of other unexpected tunneled packets. This issue arises from the switch's failure to verify the tunnel protocol type.