CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.24)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability was identified in Baicells EG3661M BaiCE_BQ6_2.0.5.3_NA in the LuCI Web Interface component, specifically in the file /cgi-bin/luci. Manipulation of the arguments MaxHops/Timeout/Size leads to OS command injection. The attack can be launched remotely, and the exploit is publicly available.
A vulnerability was identified in Raisecom Communication Command and Dispatch Management Platform up to version 7.6.5 in the file /app/users/getpwd.php. Manipulation of the argument sip leads to SQL injection. The attack can be executed remotely, and the exploit is publicly available.
A vulnerability was found in DTStack Taier 1.4.0 in the function Paths.ge of the file FileChunkController.java in the Chunk-Check Endpoint component. Manipulation of the argument Name results in path traversal. The attack may be launched remotely, and the exploit has been made public.
A vulnerability was determined in dromara lamp-cloud up to version 5.10.0 in the file FileChunkController.java of the chunk-check endpoint component. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely, and the exploit has been publicly disclosed.
A vulnerability was found in Dromara lamp-cloud up to version 5.10.0 in the file FileAnyoneController.java of the File-Upload Controller component. Performing a manipulation of the argument bucket/bizType results in path traversal. The attack can be initiated remotely, and the exploit has been made public.
A vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1.0.0. Affected is the function explore_url of the file src/mcp-rdf-explorer/server.py of the component MCP Server. Performing a manipulation of the argument url results in server-side request forgery. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
OpenChoreo up to version 1.2.0 has a vulnerability where authorization for commands and wirelogs uses the caller-supplied project parameter instead of the actual component owner. A user with project-scoped grants can execute commands and read wirelogs in components of other projects in the same namespace.
OpenChoreo before versions 1.0.4, 1.1.4, and 1.2.0-rc.2 has a vulnerability in Workflow Plane templates where developer-controlled parameters are interpolated into shell code executed via sh -c instead of being passed through container.env. This allows arbitrary commands to run in workflow pods, and affected privileged Podman templates lacked hostUsers: false.
OpenChoreo before versions 1.0.4, 1.1.4, and 1.2.1 has a vulnerability in the Backstage backend where default authentication policy is hardcoded to be disabled and guest access is allowed outside development. This results in unauthenticated access to /api/*, allowing unauthenticated catalog reads, scaffolder log reads, and catalog location creation or deletion.
FreePBX from version 17.0.5.34 to 17.0.11 has a vulnerability in the publicKeySave AJAX endpoint in Backup.class.php, which accepts an administrator's SSH key and appends it to authorized_keys without reliably enforcing restrictions. The key grants persistent shell access with the ability to execute arbitrary commands, access FreePBX and call data, modify system files, and disrupt services.
FreePBX from version 17.0.1 to 17.0.7 has a vulnerability in the Music on Hold module that permits dangerous command-line options for /usr/bin/mpg123 and other allowed players. An administrator can use options that write files, open control channels, or create Asterisk call files, resulting in arbitrary command execution as the asterisk user.
FreePBX before versions 16.0.47 and 17.0.30 has a vulnerability in the Framework module that allows a crafted backup to restore the hidden AUTHTYPE setting with the value none. An authenticated user with backup-restore access can disable FreePBX authentication during restoration, bypassing the UI removal of AUTHTYPE=none.
FreePBX before versions 16.0.6 and 17.0.5.4 has a vulnerability in the Text-To-Speech module that allows an administrator to save a TTS destination name that is HTML-encoded, decoded during dialplan generation, passed as an AGI argument, and used to build filenames in agi-bin/propolys-tts.agi. The destination name reaches a raw shell-command execution path, allowing arbitrary OS command execution as the asterisk user.
Trigger.dev from version 4.4.2 to 4.5.0 has a vulnerability in packet presign routes where a caller-controlled filename is passed to generate presigned URLs, allowing directory traversal to escape the object-store prefix and enabling a project API key to read or overwrite another organization's offloaded task payloads on multi-organization self-hosted instances.
Trigger.dev from version 4.4.2 to 4.5.0-rc.5 has a vulnerability in Aws4FetchClient.buildUrl() and presign() where user-controlled packet keys are assigned to URL.pathname, and the route accepts params without rejecting dot segments and without per-resource ownership validation. WHATWG path normalization collapses .. segments before signing, allowing a caller with a valid environment API key to obtain presigned URLs for another tenant's object-store keys and read or overwrite task payloads.
JupyterLab from version 3.3.0 to 4.5.10 and 4.6.2 has a vulnerability in notebook settings where sideBySideLeftMarginOverride and sideBySideRightMarginOverride are not properly validated before being inserted into style content. A crafted settings file can contain instructions that execute as code, and importing it or automatic application by an attacker can lead to code execution with the user's access.
Budibase prior to 3.39.18 contains a SQL injection vulnerability in the MySQL integration where the table name is not properly escaped in a DESCRIBE statement. An attacker can create a table with a name containing a backtick and stacked statement, which executes during schema discovery by an administrator. Fixed in version 3.39.18.
Budibase prior to 3.39.24 has a vulnerability in the POST /api/public/v1/roles/assign endpoint where appBuilder.appId or role.appId is not validated. An app-scoped builder can grant themselves builder access or arbitrary roles in another app, exposing data, datasource configuration, and automations. Fixed in version 3.39.24.
Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations via the read API to obtain live backend database credentials and service account keys.
Budibase before 3.40.0 contains an authorization/authentication bypass in the PUT /api/global/users/tenant/owner endpoint. On self-hosted instances, any authenticated user, including a lowest-privilege BASIC app user, can reassign the tenant account-holder email to an attacker-controlled address. The attacker can then use the public password-reset flow to take over the admin account, leading to full administrative access.