CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Responsive FileManager allows an unauthenticated attacker to upload files of any type and extension without restriction using the dialog.php endpoint, leading to Remote Code Execution.
CVE-2026-49757 is an authentication bypass vulnerability in AshAuthentication that allows local user account takeover via OAuth2/OIDC sign-in. The issue arises from using the email address as a unique identifier instead of the iss/sub combination from OpenID Connect.
The WP MAPS PRO WordPress plugin before version 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuing its map script, unconditionally creates an administrator account and returns a magic-login URL granting interactive admin access.
The GD library for Perl before version 2.86 has an OS command injection and file overwrite vulnerability in the _make_filehandle function. It opens a filename argument with Perl's 2-arg open(), which interprets prefixes like '| cmd' as a pipe, allowing arbitrary command execution or file overwrite.
Nefteprodukttekhnika BUK TS-G Gas Station Automation System versions 2.9.1 through 2.10.2 on Linux contains an Improper Authentication vulnerability (CWE-287) in the system configuration module.
Model Context Protocol (MCP) before version 0.25.0 lacked Origin header validation to prevent DNS rebinding attacks. Version 0.25.0 introduces the --allowed-hosts flag, which defaults to '*' and warns about potential vulnerabilities.
State mutation vulnerability in OpenClaw before 2026.5.27 in node pairing reconnection logic. Attackers can exploit reconnection logic to restore or present broader node authority than intended, potentially bypassing approval restrictions.
ApostropheCMS is a Node.js content management system that, in versions up to 4.30.0, allows unauthorized modifications to object prototypes by authenticated editors. The use of the `$pullAll` operator enables writing arbitrary values to `Object.prototype`, leading to authorization bypass on all REST API endpoints.
Nezha Monitoring prior to version 2.0.13 has a vulnerability in the NoRoute handler in the dashboard that allows access to admin assets without authentication. By exploiting an incorrect URL prefix check, an attacker can access system files.
Nezha Monitoring versions from 1.4.0 to before 2.0.8 allow RoleMember users to create scheduled cron tasks that can execute arbitrary commands on servers, including those belonging to other users. This poses a risk of unauthorized access to systems.
A web page containing unusual WebGPU content can load it into the GPU GLES render process, leading to an out-of-bound write in the GPU user-space driver. This may result in memory corruption and possible browser/GPU process crash.
Vulnerability in sanitize-html library (versions prior to 2.17.4) in default configuration allows bypassing sanitization and injecting HTML/JavaScript via the <xmp> element. This can lead to stored XSS in applications rendering sanitized output.
Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image. Once this salt is recovered from any device, an attacker can generate valid signatures for arbitrary device or account operations, leading to request forgery and impersonation.
SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. Identity tokens submitted during login are accepted without verifying their cryptographic signature, allowing a remote, unauthenticated attacker to obtain a fully authenticated technician session.
SQL injection vulnerability in MariaDB (versions 3.3.18 and 3.4.8) despite using mysql_real_escape_string() with big5 charset. Fixed in versions 3.3.19 and 3.4.9.
A vulnerability in MariaDB on Windows with the CONNECT engine installed and REST support enabled allows interpolation of the table HTTP attribute into the curl command line without proper sanitization. This enables the user to execute shell commands on the server.
Aqara Home Android app (version 6.0.0) and white-label clients embedding the same liblumidevsdk.so library use hard-coded cryptographic keys (CWE-321). This allows an unauthenticated remote attacker to compromise confidentiality and integrity of data with a CVSS score of 9.1 (Critical).
The Aqara Cloud OAuth Authorization Endpoint (open-cn.aqara.com/oauth/authorize) is vulnerable to a redirect bypass due to lax controls on domain matching. This is an instance of CWE-1289: Improper Validation of Unsafe Equivalence in Input.
The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes unauthenticated bidirectional AES access to the platform's signing key. This is a missing authentication for a critical function and use of a risky cryptographic algorithm.
The Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api) would authorize any valid developer token for access to any account. This is a missing authorization (CWE-862) with a critical CVSS score of 9.6.