CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access can access the Avi Control plane without authentication.
Authorization bypass in Avo framework (Ruby on Rails) allowing low-privileged users to attach related records directly, leading to privilege escalation and cross-tenant data exposure. Fixed in versions 3.32.1 and 4.0.0.beta.51.
The ps_facetedsearch module for PrestaShop from version 3.0.0 to 4.0.4 (before 4.0.4) contains a deserialization vulnerability. The module rebuilds selected search filters from the request URL, and the value of a slider filter (price or weight) is taken from the URL without sufficient validation and stored in an internal filter-block cache where it is serialized and later read back with a raw unserialize(). An unauthenticated attacker can smuggle a malicious serialized PHP object into the cache, and when deserialized, a gadget chain writes an arbitrary PHP file inside the module's directory, which is then used as a webshell to run commands on the server.
SQL injection vulnerability in the order() method of CrudOption.java in cool-admin-java 8.0.0.
CodeIgniter before version 4.7.3 contains a vulnerability in the ext_in validation rule, which checks the extension based on the detected MIME type rather than the actual file extension. A file named shell.php with GIF content can pass validation, potentially leading to arbitrary code execution.
IBM Langflow OSS versions 1.0.0 through 1.10.1 contain hard-coded credentials (passwords or cryptographic keys) used for inbound authentication, outbound communication, or internal data encryption.
IBM Langflow OSS 1.0.0 through 1.10.0 contains a path traversal vulnerability in the APIRequest component, where filenames from Content-Disposition headers are not sanitized. An attacker can write arbitrary files to locations accessible by the Langflow process.
IBM Langflow OSS versions 1.0.0 through 1.10.0 allow authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions.
IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in webhook authentication logic that allows unauthenticated users to trigger execution of any flow when WEBHOOK_AUTH_ENABLE is set to False (default).
Critical vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0 in the /api/v1/validate/code endpoint. Allows an authenticated attacker to execute arbitrary Python code on the server without sandboxing, leading to remote code execution.
IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching mechanism. The AsyncDiskCache class uses Python's unsafe pickle.loads() function to deserialize cached objects without validation, integrity verification, or authentication.
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with a SQL Injection in WP_Query (CVE-2026-60137), could allow SQL Injection and Remote Code Execution.
An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the sbin/adbd component.
django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmd_receive and cmd_send fields on the Partner model. These fields are passed directly to os.system() in pyas2/utils.py without sanitization, allowing an authenticated admin user to execute arbitrary commands on the server when an AS2 message is received or sent.
Feng Office 3.11.13.11 has an unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php. Remote attackers can upload malicious files (e.g., .html) to the web-accessible /tmp/ directory.
IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 do not properly neutralize input during web page generation, allowing remote attackers to execute arbitrary scripts (XSS).
An output mismatch between the RTL and the netlist of the or1200 cpu output port in openRISC OR1200 (commit 83ac6b) can lead to unexpected behavior.
IBM Langflow OSS versions 1.0.0 through 1.10.0 (up to commit 94981c443d4918517b9e8163d70fc598dc33a32d) contain a code injection vulnerability in the Policies component's ToolGuard integration that bypasses the allow_custom_components=false security control, allowing authenticated users with flow creation privileges to execute arbitrary Python code on the server.
Vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0. The /api/v1/login/auto_login endpoint issues long-lived superuser bearer tokens without authentication when AUTO_LOGIN is enabled (default). Permissive CORS settings may expose tokens to untrusted origins.
IBM Langflow OSS versions 1.0.0 through 1.10.0 allow unauthenticated attackers to create unlimited user accounts. When NEW_USER_IS_ACTIVE=true is set, new accounts are immediately active and can access RCE endpoints.