CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability was identified in Tenda G0 up to 20260625. The function formSetPortMirror in /goform/module of the httpd Web Management Interface is affected. Manipulating the argument portMirrorMirroredPorts leads to stack-based buffer overflow. The attack can be executed remotely, and the exploit is publicly available.
A vulnerability was determined in Tenda AC1206 15.03.06.23_multi_TD01. The function set_wl_guest_iplist in /goform/WifiGuestSet of the httpd web management interface is affected. Manipulating the argument shareSpeed causes stack-based buffer overflow. Remote exploitation is possible, and the exploit has been publicly disclosed.
A vulnerability was found in Tenda AC1206 15.03.06.23_multi_TD01. The function set_device_name in /goform/SetOnlineDevName of the httpd web management interface is affected. Manipulating the argument devName results in stack-based buffer overflow. The attack may be launched remotely, and the exploit has been made public.
The W3 Total Cache plugin for WordPress up to version 2.10.3 is vulnerable to Stored Cross-Site Scripting via Comment Author Name due to insufficient input sanitization and output escaping. The vulnerability is only exploitable when the Lazy Load Images feature is enabled, as the unsafe re-emission occurs exclusively within the LazyLoad mutator's img tag rewriting step.
A vulnerability was identified in Baicells EG3661M BaiCE_BQ6_2.0.5.3_NA in the LuCI Web Interface component, specifically in the file /cgi-bin/luci. Manipulation of the arguments MaxHops/Timeout/Size leads to OS command injection. The attack can be launched remotely, and the exploit is publicly available.
A vulnerability was identified in Raisecom Communication Command and Dispatch Management Platform up to version 7.6.5 in the file /app/users/getpwd.php. Manipulation of the argument sip leads to SQL injection. The attack can be executed remotely, and the exploit is publicly available.
A vulnerability was found in DTStack Taier 1.4.0 in the function Paths.ge of the file FileChunkController.java in the Chunk-Check Endpoint component. Manipulation of the argument Name results in path traversal. The attack may be launched remotely, and the exploit has been made public.
A vulnerability was determined in dromara lamp-cloud up to version 5.10.0 in the file FileChunkController.java of the chunk-check endpoint component. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely, and the exploit has been publicly disclosed.
A vulnerability was found in Dromara lamp-cloud up to version 5.10.0 in the file FileAnyoneController.java of the File-Upload Controller component. Performing a manipulation of the argument bucket/bizType results in path traversal. The attack can be initiated remotely, and the exploit has been made public.
A vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1.0.0. Affected is the function explore_url of the file src/mcp-rdf-explorer/server.py of the component MCP Server. Performing a manipulation of the argument url results in server-side request forgery. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
OpenChoreo up to version 1.2.0 has a vulnerability where authorization for commands and wirelogs uses the caller-supplied project parameter instead of the actual component owner. A user with project-scoped grants can execute commands and read wirelogs in components of other projects in the same namespace.
OpenChoreo before versions 1.0.4, 1.1.4, and 1.2.0-rc.2 has a vulnerability in Workflow Plane templates where developer-controlled parameters are interpolated into shell code executed via sh -c instead of being passed through container.env. This allows arbitrary commands to run in workflow pods, and affected privileged Podman templates lacked hostUsers: false.
OpenChoreo before versions 1.0.4, 1.1.4, and 1.2.1 has a vulnerability in the Backstage backend where default authentication policy is hardcoded to be disabled and guest access is allowed outside development. This results in unauthenticated access to /api/*, allowing unauthenticated catalog reads, scaffolder log reads, and catalog location creation or deletion.
FreePBX from version 17.0.5.34 to 17.0.11 has a vulnerability in the publicKeySave AJAX endpoint in Backup.class.php, which accepts an administrator's SSH key and appends it to authorized_keys without reliably enforcing restrictions. The key grants persistent shell access with the ability to execute arbitrary commands, access FreePBX and call data, modify system files, and disrupt services.
FreePBX from version 17.0.1 to 17.0.7 has a vulnerability in the Music on Hold module that permits dangerous command-line options for /usr/bin/mpg123 and other allowed players. An administrator can use options that write files, open control channels, or create Asterisk call files, resulting in arbitrary command execution as the asterisk user.
FreePBX before versions 16.0.47 and 17.0.30 has a vulnerability in the Framework module that allows a crafted backup to restore the hidden AUTHTYPE setting with the value none. An authenticated user with backup-restore access can disable FreePBX authentication during restoration, bypassing the UI removal of AUTHTYPE=none.
FreePBX before versions 16.0.6 and 17.0.5.4 has a vulnerability in the Text-To-Speech module that allows an administrator to save a TTS destination name that is HTML-encoded, decoded during dialplan generation, passed as an AGI argument, and used to build filenames in agi-bin/propolys-tts.agi. The destination name reaches a raw shell-command execution path, allowing arbitrary OS command execution as the asterisk user.
Trigger.dev from version 4.4.2 to 4.5.0 has a vulnerability in packet presign routes where a caller-controlled filename is passed to generate presigned URLs, allowing directory traversal to escape the object-store prefix and enabling a project API key to read or overwrite another organization's offloaded task payloads on multi-organization self-hosted instances.
Trigger.dev from version 4.4.2 to 4.5.0-rc.5 has a vulnerability in Aws4FetchClient.buildUrl() and presign() where user-controlled packet keys are assigned to URL.pathname, and the route accepts params without rejecting dot segments and without per-resource ownership validation. WHATWG path normalization collapses .. segments before signing, allowing a caller with a valid environment API key to obtain presigned URLs for another tenant's object-store keys and read or overwrite task payloads.
JupyterLab from version 3.3.0 to 4.5.10 and 4.6.2 has a vulnerability in notebook settings where sideBySideLeftMarginOverride and sideBySideRightMarginOverride are not properly validated before being inserted into style content. A crafted settings file can contain instructions that execute as code, and importing it or automatic application by an attacker can lead to code execution with the user's access.