CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The WP Courses LMS plugin for WordPress up to version 3.2.29 has an Insecure Direct Object Reference vulnerability via the 'resultID' parameter. Authenticated attackers with custom-level access can read other users' quiz answers and scores by enumerating resultID values.
SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability. An unauthenticated attacker could supply specially crafted input that triggers excessive processing within the affected functionality. Successful exploitation could exhaust system resources and make the service unavailable, resulting in a high impact on availability. There is no impact on confidentiality and integrity.
OpenEXR versions 3.1.0-3.2.10, 3.3.0-3.3.12, and 3.4.0-3.4.13 have an integer overflow in unpack_sample_table(), leading to a read from an invalid memory address and crash when decoding a crafted deep tiled EXR file.
OpenEXR before versions 3.2.10, 3.3.12, and 3.4.13 has an infinite-loop vulnerability in roundListSizeUp() in SampleCountChannel. Supplying UINT_MAX causes the loop to never exit, leading to application hang (denial of service).
OpenEXR versions 3.4.0-3.4.12 have a NULL pointer dereference in exr_attr_set_bytes(). Supplying a positive hint_length with a NULL type_hint causes a deterministic crash, leading to denial of service.
OpenEXR before versions 3.2.10, 3.3.12, and 3.4.13 has a heap out-of-bounds write in SampleCountChannel::set(). An error in Y coordinate calculation can lead to writes before the buffer, potentially causing memory corruption and crashes.
OpenEXR versions 3.4.0-3.4.12 have a reachable assertion failure in the HTJ2K decode path, allowing a crafted HTJ2K-compressed EXR file to cause an unconditional process abort in any application that calls exr_start_read() on untrusted input, resulting in denial of service.
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a crafted HTJ2K-compressed EXR file causes an unconditional process abort in any application that calls exr_start_read() on untrusted input, resulting in denial of service. The crash is triggered by a QCD marker whose lower five bits are zero, which OpenEXR passes into the vendored OpenJPH library while constructing the codestream and evaluating its quantization delta parameters. OpenJPH uses an assertion rather than a recoverable error to validate those bits, so any invalid value calls abort() directly and cannot be intercepted by surrounding error handling, a problem compounded by OpenEXR wrapping only its internal HT header parser in error handling while leaving the later codestream read and construction calls unprotected. This issue has been resolved in version 3.4.13.
Faveo Helpdesk up to version 2.0.3 contains a path traversal vulnerability in the unlink function of SettingsController.php (Logo Handler component). Manipulation of the data1 argument allows remote file deletion. The exploit has been publicly disclosed and may be used.
Faveo Helpdesk up to 2.0.3 has a missing authentication flaw in the post-ticket-reply endpoint (FormController::post_ticket_reply). The attack can be initiated remotely, and the exploit has been published. The project was informed but has not responded.
Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.
Unauthenticated Cross Site Scripting (XSS) in Stripe Payments <= 2.1.2 versions.
Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads <= 1.2.0 versions.
Unauthenticated Privilege Escalation in TranslatePress versions up to 3.3.2.
AutomatorWP versions up to 5.8.3 have a Subscriber Broken Access Control vulnerability, allowing subscribers to access unauthorized functionality.
Unauthenticated PHP Object Injection in The Events Calendar versions up to 6.17.2.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Toolset Blocks versions up to and including 1.6.26.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Event Tickets versions up to and including 5.29.2.1.
Unauthenticated PHP Object Injection in WP Project Manager versions up to 4.0.6.
Unauthenticated Broken Authentication vulnerability in WPLegalPages versions up to and including 3.7.0.