CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.25)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in the Kirby content management system allows a remote attacker to bypass local IP checks and install the Panel and create the first admin account. The issue affects versions prior to 4.9.4 and 5.4.4 when the server runs behind a reverse proxy that sets the Forwarded, X-Client-IP, or X-Real-IP request headers.
An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS software allows an unauthenticated attacker with network access to inject malicious XML content, potentially leading to information disclosure or corruption of internal LSVPN satellite data. Panorama, Cloud NGFW, and Prisma Access are not affected by this vulnerability.
Metabase prior to versions 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4 deserializes arbitrary Java objects returned in OTHER type columns from H2 native queries without validation. An authenticated user able to run native H2 queries can execute code on the Metabase server.
Metabase, an open-source business intelligence tool, contains a vulnerability allowing an authenticated administrator to execute arbitrary Java code on the server by registering a crafted H2 database connection. The issue affects versions from 1.55.0 up to 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2.
Ruflo prior to 3.16.3 exposes MCP bridge POST /mcp and POST /mcp/:group endpoints without authentication, allowing an unauthenticated network attacker to execute commands in the bridge container, read provider API keys, and poison AgentDB learning-store patterns.
An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W allows an unauthenticated remote attacker to temporarily render an individual TCP connection unusable by sending an RTSP request with a Content-Length header but no message body. The parser enters a body-waiting state and consumes all subsequent data until timeout.
The MERCURY MIPC252W IP camera firmware version 1.0.5 Build 230306 Rel.79931n does not implement nonce expiration in RTSP Digest authentication. An adjacent network attacker can capture a legitimate authentication exchange and replay the nonce and response values in a new connection to bypass authentication without knowledge of the device credentials.
A vulnerability in the PayRange app version 7.0.7 allows JavaScript injection into a WebView when combined with an SSL bypass. Injecting specific JavaScript function calls enables the attacker to escape the WebView sandbox and perform dangerous actions on the user's device.
CVE-2026-42486 in XAPI allows a vm-admin user to set the VM.platform:hvm_serial parameter, which should be restricted to the pool-admin role. This enables arbitrary file write in dom0, potentially leading to privilege escalation and system compromise.
CVE-2026-23562 in XAPI (XenServer API) allows a vm-admin user to configure PCI passthrough, which is normally restricted to the pool-admin role. A missing permission check in one API grants unintended access to host hardware.
In XAPI, a user with the vm-admin role can set the VM.other_config:storage_driver_domain parameter, marking a VM as the storage domain for a PBD connection. Shutting down such a VM may cause the PBD to be erroneously marked as unplugged when it is not.
Vulnerability CVE-2026-23560 in XAPI allows a vm-admin user to set the VM.other-config:is_system_domain parameter, marking a virtual machine as a system domain. Such domains are ignored and left running during host or pool operations, and may be hidden from administrative tools.
A user with the vm-admin role in XAPI can set the VBD.other_config:backend-local parameter, allowing arbitrary files in dom0 to be turned into virtual disks (VDIs) and attached to a controlled VM. This enables unauthorized read and modification of files in dom0.
When oxenstored tears down a domain, node data is cleaned up but usage counts are leaked. When the domain ID is reused, the new domain can create fewer nodes before being deemed over quota.
A vulnerability in the varstored component of the Xapi toolstack handling UEFI variables for VMs. Insufficient compiler barriers create TOCTOU issues in a shared buffer with OVMF, potentially allowing an attacker to control an index used in a jump table.
Multiple issues exist in XAPI: (1) database updates sanitize input strings but generate notifications from unsanitized input, causing the database event thread to terminate; (2) XAPI's UTF-8 encoder implements Unicode v3.0 while libraries use v3.1, leading to acceptance of invalid strings that can prevent database loading; (3) no input sanitization for Map/Set updates on database objects.
CVE-2025-27464 affects the XenBus driver for Windows, which lacks a security descriptor, allowing unprivileged users full access to its facilities.
CVE-2025-27463 affects the XenIface driver in Windows PV drivers. The lack of a security descriptor allows unprivileged users full access to this interface.
The Windows PV drivers (XenCons) lack a security descriptor, allowing unprivileged users full access to the facilities exposed by this component.
A vulnerability in Xerte Online Tools allows authentication bypass and remote code execution via reinstallation through the /setup/ folder, enabling attackers to take over the service and connect it to a remote database they control.