CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.25)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in Apache Camel Cometd component allows an attacker to inject arbitrary Camel control headers into the message exchange. Missing HeaderFilterStrategy causes client-supplied headers, including internal Camel headers (e.g., CamelHttpUri, CamelFileName), to be copied unmodified. Default lack of authentication (Bayeux SecurityPolicy) lets any client publish such messages.
A deserialization vulnerability in the Apache Camel PQC component allows untrusted data deserialization from AWS Secrets Manager. The flaw stems from missing input filtering during Java object deserialization, potentially leading to remote code execution.
A vulnerability in the camel-docling component of Apache Camel allows CLI argument injection and directory traversal due to insufficient validation of exchange headers. Attackers can supply unauthorized flags or paths that escape the intended directory, leading to unexpected operations by the external docling tool.
The internal RPC interface of Apache IoTDB DataNode for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an untrusted network, an attacker may use path traversal sequences in the JAR name to write files outside the intended Trigger installation directory. This could allow arbitrary file write with the permissions of the IoTDB process.
An authentication bypass vulnerability via spoofing has been found in Apache IoTDB. Thrift RPC query handlers do not properly validate the sessionId parameter, allowing an attacker to forge requests and receive query results without authentication. Affected versions are from 1.3.3 before 2.0.8.
The WordPress plugins FileOrganizer (before 1.1.9), Advanced File Manager (before 5.4.12), File Manager Pro (before 2.1.1), and File Manager (before 8.0.4) fail to properly escape a parameter before passing it to a shell command during image processing. This allows authenticated users to perform OS Command Injection, provided the server has the ImageMagick convert CLI available and the PHP imagick and GD extensions are absent.
The Prog Management System by PROG MIS has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to view a specific page and obtain the database account and password.
The ERP application developed by PROG MIS has a Use of Hard-coded Credentials vulnerability, allowing unauthenticated remote attackers to log in to view application code and obtain the database account and password.
An unauthenticated improper input validation vulnerability in the POST /fetch_cve_data endpoint in cve-search allows a remote attacker to manipulate request parameters to read arbitrary application MongoDB collections. This can expose administrative usernames and password hashes from the mgmt_users collection.
The vulnerability in Gitea Actions Artifacts V4 stems from HMAC ambiguity in signed URLs, allowing cross-repository artifact read and cross-task upload-state write.
A vulnerability in the OAuth sign-in callback mechanism silently re-enables accounts that were disabled by an administrator. Improper authorization allows bypassing administrative account lockout decisions.
A type confusion vulnerability in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code remotely over a network.
A vulnerability in Gitea before version 1.26.0 fails to close the connection on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.
The vulnerability in Gitea before version 1.25.5 is that LFS push and sync mirror operations do not use the migration HTTP transport, bypassing the configured migration transport protections for those LFS requests.
A vulnerability in Gitea before version 1.25.5 does not correctly persist the OAuth2 PKCE S256 challenge method during authorization, allowing token exchange without the required verifier check.
A vulnerability in Gitea versions before 1.25.5 allows reusing expired or single-use OAuth2 authorization codes during token exchange. Inconsistent enforcement of code expiry and single-use behavior may lead to unauthorized access.
A vulnerability in Gitea before version 1.25.5 mishandles path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths.
CVE-2026-22874 affects Gitea versions up to and including 1.26.2. The SSRF (Server-Side Request Forgery) protection in webhook and migration allow-list filtering is incomplete, potentially allowing an attacker to make unauthorized requests to internal network resources.
In Gitea before version 1.25.5, validation constraints for repository creation fields are missing, including length-limited template fields and trust model or object format values.
Gitea Docker images up to version 1.26.2 set REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers like X-WEBAUTH-USER are enabled.