CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A sandbox escape vulnerability exists in the DOM: Workers component of Firefox and Thunderbird. The flaw was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
A use-after-free vulnerability was found in the WebGPU component of Firefox and Thunderbird. The flaw was fixed in version 152 of both applications.
CVE-2026-40750 vulnerability in themagnifico52 Kids Online Store allows unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server.
Versions of GEO my WordPress up to 4.5.5 are vulnerable to unauthenticated SQL Injection.
CVE-2026-49774 describes an improper control of code generation vulnerability that allows remote code inclusion in the RD Station application. This issue affects RD Station versions from n/a through 5.6.0.
CVE-2026-49772 describes an improper neutralization of special elements used in SQL commands, allowing for Blind SQL Injection attacks in The Events Calendar application.
There is an unauthenticated SQL injection vulnerability in InPost Gallery versions up to 2.1.4.6.
The elixir-grpc has vulnerabilities related to deserialization of untrusted data and resource allocation without limits, allowing unauthenticated attackers to crash the BEAM node via atom table exhaustion and achieve remote code execution on the server.
Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery. The first sign() on a Key object picks a nonce, and every later sign() on that same object reuses it, producing an identical 'r'.
In versions prior to 3.9.7, the i18next-http-middleware did not block dotted variants of keys such as '__proto__.polluted', leading to the potential for remote prototype pollution in applications using i18next-fs-backend version ≤ 2.6.5.
Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings, potentially allowing unauthorized writes to the global object prototype.
Socket versions before 2.041 for Perl have an out-of-bounds heap read issue. The pack_ip_mreq_source() function incorrectly checks the length of its source argument, leading to copying adjacent heap memory when the source is shorter than 4 bytes.
Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce. The default nonce was generated using an MD5 hash of the epoch time, which is predictable.
Versions up to 1.1.1 of the Integration for ActiveCampaign and contact forms (Contact Form 7, WPForms, Elementor, Ninja Forms) are vulnerable to unauthenticated PHP object injection.
There is an unauthenticated Path Traversal vulnerability in FastDup versions <= 2.7.2.
Versions of the eCommerce Product Catalog up to 3.5.5 are vulnerable to unauthenticated SQL injection.
There is an unauthenticated PHP Object Injection vulnerability in OttoKit versions <= 1.1.27.
The GPTranslate plugin in versions up to 2.32.6 has a vulnerability to unauthenticated SQL Injection, allowing malicious queries to be executed against the database.
There is an unauthenticated PHP Object Injection vulnerability in WP Travel Engine versions up to 6.7.12.
There is an unauthenticated PHP Object Injection vulnerability in wpForo Forum versions <= 3.1.0.