CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.24)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
On April 29, 2026, malicious versions of npm packages `@cap-js/[email protected]`, `@cap-js/[email protected]`, and `@cap-js/[email protected]` were published. These packages harvested credentials and attempted self-propagation within the victim's environment.
A vulnerability in OpenWrt prior to 25.12.5 allows newline injection into /tmp/odhcpd.leases via the DHCPv6 FQDN option 39 hostname. Lack of escaping enables forged lease lines that are rendered as live HTML on the Active DHCPv6 Leases admin page in LuCI.
Better Auth library before version 1.6.11 has a vulnerability in the @better-auth/sso plugin. The POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled URLs (oidcConfig.userInfoEndpoint, tokenEndpoint, jwksEndpoint) when skipDiscovery: true is set, store them without origin validation, and fetch them during OIDC callback, allowing non-blind server-side request forgery (SSRF) and potential account linking when trustEmailVerified: true is configured.
Better Auth before version 1.6.11 has a vulnerability in the legacy oidcProvider and mcp plugins where OAuth token endpoints authenticate only possession of a valid refresh_token and client_id, without verifying the client_secret. This allows an attacker with a valid refresh_token to mint access tokens and rotated refresh tokens via /api/auth/oauth2/token or /api/auth/mcp/token.
In FastGPT up to commit 22ebfacbb43311e9b73294040ae0eb87390c6bba, artifacts built from untrusted pull request code in GitHub Actions workflows can be downloaded by privileged workflow_run jobs, allowing an attacker to push controlled Docker images to GHCR and, for documentation previews, deploy with the secret KUBE_CONFIG_CN.
The Pegatron `Tdelo64.sys` driver improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interface. IOCTL handlers including `TDE_IOCTL_INDEXIO_READ` and `TDE_IOCTL_INDEXIO_WRITE` permit unprivileged user-mode callers to perform arbitrary hardware I/O port reads and writes without authorization checks.
A stored cross-site scripting vulnerability in the RustFS Console allows an attacker to inject malicious HTML content via a .pdf file. When previewed, this content can expose administrator credentials (AccessKeyId, SecretAccessKey, SessionToken). Affects versions 0.1.7 through 0.1.9 and is a regression of CVE-2026-27822.
In Lightpanda before version 0.2.9, fetch() and XMLHttpRequest unconditionally attach session cookies to every HTTP request, ignoring credentials: omit, same-origin, include, and XMLHttpRequest.withCredentials. This allows an attacker-controlled origin in a Lightpanda session to issue authenticated cross-origin requests against a victim origin.
A vulnerability in Lightpanda before version 0.3.1 allows bypassing the Same-Origin Policy by incorrectly parsing the @ character in URLs. An attacker can craft a URL like http://attacker.com/@victim.com/, which is fetched from attacker.com but treated as originating from victim.com.
A vulnerability in Metabase allows a user with permission to add or edit database connections to achieve remote code execution on the Metabase server. It exploits a flaw in the Snowflake JDBC driver that can write arbitrary files anywhere on the host, including replacing Metabase's own database driver files that later execute inside the Metabase process.
A vulnerability in Penpot prior to 2.14.5 allowed account takeover by exploiting invitation tokens, embedding a profile ID, and issuing a session based on email match without password verification.
In LightRAG prior to 1.5.4, when LIGHTRAG_API_KEY is set but AUTH_ACCOUNTS is unset, X-API-Key protection can be bypassed. The system falls back to a hardcoded DEFAULT_TOKEN_SECRET, and /auth-status and /login can mint guest JWTs that are accepted before checking the API key. A remote unauthenticated attacker can call guarded endpoints, including document read, upload, deletion, graph mutation, and query endpoints.
LightRAG before version 1.5.4 defaults to CORS_ORIGINS=* combined with allow_credentials=True, causing Starlette CORSMiddleware to whitelist every origin for credentialed cross-origin requests. An attacker can make authenticated API requests from a malicious website, exfiltrating documents and knowledge graph data or performing destructive actions.
A path traversal (Tar Slip) vulnerability in Cornac before version 2.6.0 allows an attacker to write arbitrary files outside the intended cache directory by supplying a crafted TAR archive containing ../ sequences, absolute paths, or symlink/hardlink entries to the _extract_archive() function in cornac/utils/download.py. Attackers can trigger this vulnerability through the built-in dataset loaders, which automatically download and extract archives, causing archive.extractall() to write files to arbitrary locations on the filesystem accessible to the running process.
The Grav API plugin (grav-plugin-api) before version 1.0.4 does not validate the origin of the admin_base_url field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl() function only checks the URL scheme (http/https) and never verifies the host against the server's own origin, allowing an attacker to supply an arbitrary host. An unauthenticated attacker can cause the password reset email sent to a victim to contain a reset link pointing at an attacker-controlled server; when the victim follows the link, the valid reset token is disclosed to the attacker, enabling full account takeover.
An improper validation of integrity check value and improper certificate validation in certain ASUS router models allows a remote man-in-the-middle (MITM) attacker to force the router to download and execute arbitrary commands from a spoofed server.
An authentication bypass vulnerability in Ciena Navigator NCS, MCP, and Blue Planet products due to improper handling of HTTP request paths and headers. An unauthenticated attacker can manipulate requests to bypass authentication and audit logging.
In Ciena's Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), hidden system accounts with default, predictable passwords were discovered. These accounts have very limited permissions but could be used by an attacker in combination with other weaknesses to escalate privileges on the system.
A buffer overflow vulnerability has been discovered in the OpenHTJ2K library version 0.18.4 and earlier. An attacker can exploit this flaw in the invoke, invoke_line_based, invoke_line_based_stream, and invoke_line_based_predecoded functions in decoder.cpp, allowing arbitrary code execution.
A heap-based out-of-bounds write vulnerability exists in OpenHTJ2K versions 0.18.3 and earlier. The issue occurs in j2k_precinct_subband::parse_packet_header() due to missing bounds validation before writing coding-pass lengths to the j2k_codeblock::pass_length[128] array.