CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.25)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
FreeRDP versions 3.21.0 through 3.27.9 contain an incomplete fix for CVE-2026-23530 in the planar_decompress_plane_rle_only function in planar.c. A malicious RDP server can send a crafted planar RDPGFX_CMDID_WIRETOSURFACE_1 payload that reads one byte past the input buffer.
In 32-bit builds of FreeRDP prior to 3.28.0, an integer overflow occurs in the update_read_delta_points function in libfreerdp/core/orders.c. A malicious RDP server can exploit this to allocate an undersized heap buffer and write beyond its bounds.
MCP Server Kubernetes before version 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can inject the --server flag to redirect kubectl commands to an attacker-controlled API server, causing the operator's bearer token to be transmitted externally and enabling full cluster compromise.
An SQL injection vulnerability in SEM-PMP by Semtek Informatics Software Consulting Trade Ltd. Co. allows command line execution through SQL injection. The issue affects versions up to 23042026.
A vulnerability in Prowler before 5.30.3 allows an attacker to take over accounts in another tenant by manipulating the email address in a SAMLResponse. The system trusted the email domain from the SAMLResponse when selecting the tenant, instead of binding the token to the validated SAML configuration.
An SQL injection vulnerability (CWE-89) has been found in MobilMen 20T by Adam Retail Automation Ltd. The flaw allows an attacker to manipulate database queries due to improper neutralization of special elements in SQL commands.
The database plugin for Grav CMS prior to version 1.2.0 contains an SQL injection vulnerability in the PDO::tableExists method. The table name passed by plugin or developer code is directly interpolated into a raw SQL query without sanitization, allowing arbitrary SQL execution.
An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser component. This vulnerability can be exploited to gain unauthorized administrative access.
In 9Router prior to version 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the ALWAYS_PROTECTED middleware check, which only validates JWT or CLI token. This issue is fixed in version 0.4.80.
A flaw was found in the file_type content detector of guardrails-detectors, allowing a remote attacker to supply an arbitrary XSD string processed without restrictions. This can lead to server-side requests to arbitrary URLs or local file reads.
PraisonAI before version 4.6.78 contains a code injection vulnerability in deploy/api.py where the agents_file parameter is directly interpolated into an f-string without sanitization. Attackers can inject arbitrary Python code that executes when the generated server code runs via subprocess.Popen().
In JetBrains IntelliJ IDEA before 2026.1.4 and 2026.2, a vulnerability allowed code execution via path traversal in project workspace ID handling.
A vulnerability in Vikunja before version 2.2.1 allows unauthorized access to share hashes and downloading/deleting all file attachments across the instance. An authorization flaw in the LinkSharing.ReadAll and GetTaskAttachment endpoints enables privilege escalation to admin-level shares.
A vulnerability in Dell PowerFlex Manager prior to version 5.1.0.1 allows OS command injection. A high-privileged attacker with remote access can exploit this during OS Repository processing to execute arbitrary commands as root.
In the Linux kernel xfrm iptfs module, iptfs_consume_frags() fails to propagate the SKBFL_SHARED_FRAG flag when transferring fragments between socket buffers. This can lead to incorrect in-place encryption by ESP. A similar bug was fixed in CVE-2026-46300 for skb_try_coalesce().
R-SOFT DMS is vulnerable to OS Command Injection in the OCR module. Command execution functions accept user-controllable file paths without proper sanitization before passing them to the system shell via SSH. In standard web upload flow URL encoding neutralizes the injection, but an authenticated attacker who can trigger OCR for the uploaded file can execute commands as root.
A flaw in the `guardrails-detectors` component allows a remote attacker to perform a blind SSRF attack by submitting a crafted XSD string. This can lead to unauthorized access to sensitive information, including credentials from cloud metadata services, Kubernetes API, internal MinIO, and other internal network endpoints. It also enables local file reads of critical data such as service account tokens and pod secrets.
A vulnerability in Apache IoTDB allows remote code execution through unsafe reflection. The pipe processor reads a fully qualified Java class name and instantiates it using Class.forName().newInstance() without any validation or allowlisting.
A Path Traversal vulnerability was found in Apache IoTDB. An attacker can write arbitrary files anywhere the IoTDB process has write permissions using an unsafe API.
In Apache IoTDB, a vulnerability was found due to insufficient session expiration and authentication bypass via capture-replay attack. REST Basic Authentication accepts stale cached credentials.