CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.24)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In WAGO System I/O Field series devices, an internal diagnostic capability activates during the initial startup sequence. It is not formally documented and becomes accessible without authentication for a brief period in the early boot phase. During this window, an unauthenticated remote attacker can gain access to internal system processes, resulting in full system compromise.
The User Registration & Membership WordPress plugin before version 5.2.2 does not verify the authenticity of incoming payment-provider webhook notifications before acting on them. This allows unauthenticated attackers to forge a payment-approved event and activate a paid membership subscription without completing a real payment.
A vulnerability was found in Comfast CF-WR631AX V3 up to version 2.7.0.8, involving OS command injection in the system_wl_upload_pic_file function within /usr/bin/webmgnt (FastCGI Backend). The filename argument is improperly sanitized, allowing remote exploitation. The exploit has been publicly disclosed.
Flowise before version 3.1.0 (versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and issuer values ('AUDIENCE', 'ISSUER') in the enterprise passport authentication middleware. When the corresponding environment variables are not set, the application silently falls back to these publicly known defaults, allowing an attacker to forge valid JWTs and impersonate any user, including administrators.
Crawl4AI before version 0.8.7 has an arbitrary file write vulnerability in the /screenshot and /pdf endpoints of the Docker API server. The output_path parameter accepts arbitrary filesystem paths without validation, allowing an attacker to overwrite server files and cause denial of service.
PraisonAI before version 1.6.78 contains a remote code execution vulnerability in the CodeAgent._execute_python() function, which executes LLM-generated Python code without AST validation, import restrictions, or sandbox enforcement. Attackers can influence LLM output through prompt injection to exfiltrate all environment secrets and execute arbitrary code on the host system.
PraisonAI before version 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component. Missing path validation and command sanitization in LLM tool calls allow attackers to inject malicious prompts through the chat interface.
A vulnerability in PraisonAI before version 4.6.78 allows SQL/CQL injection due to improper validation of the dimension argument in PGVector and Cassandra backends. An attacker can pass a malicious string that is directly interpolated into the CREATE TABLE query, potentially leading to unauthorized database operations.
Unauthenticated arbitrary file upload vulnerability in Joomla extension RSFiles (< 1.17.12) allowing full remote code execution.
The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation.
A vulnerability in the Drupal Commerce guest registration module allows unauthorized access. This issue affects all versions of the module.
OpenPLC Runtime v3 has an authenticated arbitrary file write vulnerability in the legacy web UI program upload workflow. An attacker can supply an arbitrary filename stored in the database and used as the destination path without validation, allowing file writes anywhere writable by the webserver process.
A vulnerability has been discovered in Drupal Mother May I that may allow unauthorized access or other threats. This issue affects all versions of the Mother May I module.
The Tilt HUD HTTP server in versions 0.20.8 through 0.37.3 registers handlers on a gorilla/mux router with no authenticating middleware. When bound to a non-loopback address, an unauthenticated network caller can trigger developer-defined resources, tamper with Tiltfile arguments, read full engine state including the session token, and invoke apiserver resources via the token-attaching /proxy handler.
An improperly controlled modification of dynamically-determined object attributes vulnerability in Drupal Formatter Field allows object injection. This affects versions from 0.0.0 to 2.0.0.
A missing authorization vulnerability in Drupal LocalGov Workflows allows forceful browsing. This affects versions from 0.0.0 to 1.6.0.
An improperly controlled modification of dynamically-determined object attributes vulnerability in Drupal AlternativeCommerce (Basket) allows object injection. This affects versions from 0.0.0 to 2.1.17.
The OAuth Single Sign On - SSO (OAuth Client) plugin for WordPress contains an authentication bypass vulnerability via an alternate path or channel, allowing password recovery exploitation. This issue affects versions up to and including 38.5.8.
OpenReplay versions 1.24.0 through 1.25.0 contain an XSS vulnerability allowing an unauthenticated attacker to take over a dashboard account. The attacker can inject a malicious script via custom event names or captured page URLs, which are stored in ClickHouse without output encoding and later rendered in the dashboard, enabling theft of the JWT token from localStorage.
The miniOrange Social Login and Register plugin for WordPress up to version 7.7.0 contains an authentication bypass vulnerability leading to account takeover. An attacker can supply an arbitrary email address (e.g., admin) to the Profile Completion flow, exploit the weak OTP space (99,000 values) and leaked transaction hash to crack the OTP in under a second, and log in as the targeted user.