CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Aqara IAM/SSO Gateway (gw-builder.aqara.com) uses a hardcoded OAuth client credential, violating CWE-798 (Use of Hard-coded Credentials). This vulnerability has an estimated CVSS score of 9.1 (Critical) and allows unauthenticated remote attacks.
The Pause+ mobile app has a vulnerability related to improper restriction of excessive authentication attempts, allowing authentication bypass.
A vulnerability in the jmespath.php library allows an attacker to execute arbitrary PHP code when using the `JmesPath\CompilerRuntime` with an attacker-controlled JMESPath expression. The compiler fails to properly escape function names, enabling injection of malicious code into the generated cache file, which is then executed.
Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to write arbitrary files to the store's media directory without authentication. Attackers can upload PHP files, potentially leading to remote code execution.
In vm2, prior to version 3.11.4, a sandbox escape vulnerability allowed arbitrary code execution in the host process when untrusted code was executed with async support. This issue has been patched in version 3.11.4.
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, vm2 suffers from a sandbox breakout vulnerability, allowing attackers to execute arbitrary commands on the host system.
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins, but the denylist misses process and inspector/promises, allowing sandboxed code to bypass restrictions.
In versions prior to 3.11.4, the vm2 library contained a vulnerability that allowed bypassing security related to the 'nesting: true' and 'require: false' options. The strict equality check in the code did not function correctly, enabling unauthorized requirements.
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining certain calls, it was possible to obtain the host's TypeError constructor, allowing escape from the sandbox and execution of arbitrary code.
The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical for all users and all devices. These credentials are embedded in the application binary and are readily extractable via APK decompilation.
The iRM-IEI Remote Management developed by IEI Integration Corp has a Hardcoded Credentials vulnerability, allowing unauthenticated remote attackers to exploit hard-coded credentials to gain administrative privileges on the database.
A logic error in OAuthRequestFilter rejects legitimate requests from the bound IP address while blindly allowing requests from any other IP, creating an inverse security check.
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' claims of JWT access tokens, allowing token replay across different resource servers and enabling Token Confusion/Routing attacks.
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory construct a SAXParserFactory without proper JAXP hardening, enabling out-of-band external entity resolution.
There is an unauthorized access vulnerability in the PcSuite APP. Attackers can exploit this vulnerability to gain unauthorized access to the victim's device.
Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled, leading to unauthorized access in default installations.
Certain devices running UniFi OS are vulnerable to improper input validation, allowing a malicious actor with low privileges to execute a Command Injection attack.
A vulnerability related to improper input validation exists in devices running UniFi OS, which could be exploited by a malicious actor with low privileges to escalate privileges.
An Improper Input Validation vulnerability in UID Enterprise Agent allows a malicious actor with network access and low privileges to exploit it for Command Injection on the host device.
CVE-2026-47365 is an argument injection vulnerability in WordPress Toolkit before version 6.11.0, as used in cPanel and WHM. It allows remote authenticated users to bypass cross-tenant authorization and execute arbitrary wp-toolkit CLI commands as another account.