CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.24)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The 777 triple-seven WordPress plugin contains a deserialization of untrusted data vulnerability allowing object injection. The issue affects versions up to and including 1.13.0.
The Kirki plugin for WordPress contains a Blind SQL Injection vulnerability in versions up to and including 6.0.12. The issue is due to improper neutralization of special elements used in SQL commands.
The Kirki WordPress plugin contains a deserialization of untrusted data vulnerability allowing object injection. This affects versions up to and including 6.0.12.
The Aimogen Pro WordPress plugin contains an unrestricted file upload vulnerability with dangerous file types. This allows an attacker to upload malicious files, potentially leading to remote code execution.
The LatePoint plugin for WordPress contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This issue affects versions up to and including 5.6.3.
The WoowBot Pro Max WordPress plugin contains an unrestricted file upload vulnerability allowing dangerous file types. This enables an attacker to upload malicious files, potentially leading to remote code execution.
The Simple Business Directory Pro WordPress plugin contains an SQL injection vulnerability in versions up to and including 15.9.4. An attacker can exploit improper neutralization of special elements in SQL commands.
The Amelia WordPress plugin contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This affects versions up to and including 2.4.2.
The SureDash WordPress plugin contains a path traversal vulnerability that allows an attacker to access files outside the restricted directory. The issue affects versions up to and including 1.8.0.
A URL path injection vulnerability via unencoded user-supplied identifiers has been found in Apache Gravitino. The issue affects versions from 1.0.0 before 1.2.1.
The NPC start endpoint on the web server at port 8090 is vulnerable to command injection. An attacker can remotely execute arbitrary system commands.
A vulnerability in a web server allows arbitrary file writes via a POST request to a specific endpoint. The endpoint accepts the filename parameter in the Content-Disposition header without verification, enabling overwriting of system files or shell scripts.
The vulnerability causes sensitive information such as passwords and charging card UIDs to be written to log files. This can lead to unauthorized access to this data by individuals with log access.
The firmware update mechanism lacks cryptographic signature validation. This allows anyone with access to the firmware update capability to upload arbitrary files, potentially leading to arbitrary code execution.
The web server on port 8090 does not require authentication, allowing sensitive information leakage such as configured passwords and file uploads through various endpoints.
The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection. An attacker can remotely execute arbitrary system commands.
The EVbee Service Android app uses TLS encrypted communication but does not validate the server certificate, allowing an attacker on the network path to intercept and manipulate the communication. The traffic is weakly encrypted using RC4 with a hardcoded key, enabling an attacker to gain access to the data, including charging station access codes.
A vulnerability in Thales CERT "Suspicious" application version 1.3.4 and earlier allows a remote, unauthenticated attacker to execute arbitrary code and overwrite writable application files, including Python modules, configuration files, cron inputs, and runtime artifacts. This leads to persistent denial of service, potential compromise of application secrets or integrations, and root-level execution inside the Django application container.
A critical Server-Side Template Injection (SSTI) vulnerability in Centreon's centreon-open-tickets module. The message_confirm field is stored unsanitized and rendered via Smarty without security policy, allowing any authenticated user to inject and execute arbitrary code on the server.
The Joomla extension Helix Ultimate below version 2.2.7 is vulnerable to unauthenticated arbitrary file deletion. An attacker without logging in can delete any file on the server.