CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A use-after-free vulnerability in GPU in Google Chrome on Android prior to 150.0.7871.128 allows a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
Use after free in CameraCapture in Google Chrome on Mac prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
AVideo before 29.0 contains an incomplete fix for CVE-2026-45578. execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $() and backticks. Attackers can inject arbitrary OS commands through the Live plugin on_publish.php endpoint despite escapeshellarg() protection.
In SJCAM AllWinner Tech products (SJ4000-Air V1.4C and earlier, and WhiteLabel versions), a vulnerability allows arbitrary code execution via a crafted FEX file.
A stack overflow vulnerability was discovered in the Tenda TX9 firmware version V22.03.02.20 in the sub_425964 function of the /goform/SetOnlineDevName file. An attacker can remotely exploit this flaw to execute arbitrary code.
A stack overflow vulnerability was discovered in the Tenda TX9 firmware version V22.03.02.20 within the sub_424CE0 function of the /goform/setMacFilterCfg file. An attacker can exploit this flaw to execute arbitrary code or cause a denial of service.
A stack overflow vulnerability was discovered in Tenda TX9 firmware version V22.03.02.20 in the sub_42EEE0 function of the /goform/SetStaticRouteCfg file. An attacker can remotely exploit this flaw to execute arbitrary code or cause a device crash.
In FreeScout before version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` allows an attacker to take over a user account without authentication. The vulnerability is due to trailing space equality in MySQL/MariaDB VARCHAR and improper decryption of the `invite_sent_at` parameter.
A stack overflow vulnerability was discovered in Tenda TX9 firmware version V22.03.02.20 in the sub_42EA38 function of the /goform/SetVirtualServerCfg file. An attacker can remotely exploit this flaw to execute arbitrary code or cause a denial of service.
A stack overflow vulnerability was discovered in the Tenda TX9 firmware version V22.03.02.05 in the sub_4418CC function of the /goform/SetNetControlList file. An attacker can exploit this flaw to execute arbitrary code or cause a denial of service.
ktransformers through version 0.6.3 (fixed in commit def0f93) contains an unauthenticated pickle deserialization vulnerability that allows remote attackers to execute arbitrary commands by sending crafted pickle payloads to the SchedulerServer ZMQ ROUTER socket bound to all interfaces. Attackers can exploit malicious __reduce__ methods embedded in crafted pickle payloads to execute arbitrary shell commands as the server process.
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject shell metacharacters through path parameters to execute arbitrary OS commands as the server process user without authentication.
Vulnerability in RT (Request Tracker) before versions 5.0.10 and 6.0.3 in the REST 2.0 API allows a privileged (non-admin) user to obtain credentials of other users, including admins, and use them to read data via feeds. The request rotates the credentials, invalidating existing feed URLs.
Vulnerability in dotCMS (versions 21.02 through 26.06.22-03) in ToolGroupResource and RoleAjax REST/DWR endpoints. A low-privileged authenticated backend user can self-assign the CMS Administrator role and achieve remote code execution via a crafted OSGi bundle upload.
A vulnerability in the Net::DNS library for Perl (versions up to 1.55) allows remote code execution via a crafted EDNS EXTENDED ERROR record. The _decompose function improperly handles backtick characters (`), enabling system command injection.
The Joomla extension Page Builder CK below version 3.6.2 does not properly apply access control to frontend page list views. An authenticated user can gain unauthorized access to page lists.
The Joomla extension JDownloads versions below 4.1.6 contains an unauthenticated arbitrary file upload vulnerability. This allows a remote attacker to upload any file without authentication, leading to full remote code execution (RCE).
The Joomla extension Gridbox versions below 1.6.0 contains an authentication bypass vulnerability. An attacker can gain full administrative access without providing valid credentials.
The Joomla extension DJ-Classifieds versions below 3.11.2 is vulnerable to unauthenticated arbitrary file upload. An attacker without authentication can upload any file, leading to full remote code execution (RCE).
The Joomla extension JMedia versions below 1.6.0 is vulnerable to stored cross-site scripting (XSS). Unsanitized SVG uploads served without the nosniff header allow an attacker to inject malicious scripts that execute in other users' browsers.