CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the lack of proper decorators in certain endpoints allows any logged-in user, including the default guest role, to install and reconfigure exporters, WAF, and GeoIP databases on all servers in the Roxy-WI database.
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the PUT /smon/check functionality does not verify if the check_id belongs to the user's group, allowing unauthorized modifications to other users' monitoring settings.
The Doctreat Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 1.6.8. The doctreat_process_registration() function does not properly restrict the roles that a user can register with.
The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media type, allowing unauthenticated users to upload any file type accepted by WordPress's media library through endpoints that should only accept images or videos.
Buffer overflow in File Station 5 allows a remote attacker to modify memory or crash processes. The vulnerability is fixed in version 5.5.6.5243 and later.
Buffer overflow in File Station 5 allows a remote attacker to modify memory or crash processes. The vulnerability is fixed in version 5.5.6.5243 and later.
The vulnerability affects QTS (QNAP operating system). The vendor confirms QuTS hero is not affected. The fix is included in QTS 5.2.7.3256 build 20250913 and later.
Espressif IoT Development Framework (ESP-IDF) versions 5.5.4 and 6.0 have a vulnerability in the esp_tee component that exposes secure-service wrappers. An attacker can exploit these wrappers to gain unauthorized access to TEE-protected peripherals.
An authenticated domain user can remotely execute arbitrary code on the Backup Server.
Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation does not require user interaction and the scope is changed.
ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.
An insecure authentication vulnerability in the /api/social-sign-in endpoint of bookcars v8.3. An attacker can bypass authentication using a forged JWT token.
A lack of cryptographic signature verification in the validateAccessToken function of bookcars v8.3 allows attackers to bypass authentication via a forged JWT token.
In the bitbank2 AnimatedGIF library v2.2.0, a buffer overflow in the DecodeLZW function allows remote attackers to cause a crash or potentially execute arbitrary code via a crafted GIF file.
Shenzhen Kangda Xin Intelligent Network Technology's router DR300 (version 2.1.2.121) contains hardcoded login credentials and has telnet enabled by default on WAN and LAN interfaces. This allows attackers to read/write memory, modify firmware, inspect active connections, and view connected devices.
Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability. An attacker can inject malicious scripts into form fields, which execute in the victim's browser, potentially hijacking their account or session.
FreeSWITCH prior to version 1.11.1 has a heap overflow vulnerability in the mod_verto module. An attacker can send an HTTP POST request with a large body, causing a buffer overflow before authentication.
In FreeSWITCH prior to version 1.11.1, esl_recv_event() mishandles Content-Length, allowing a malicious ESL peer to send a frame with a negative value, causing heap corruption or process crash before authentication.
Azure Stack Edge has a vulnerability involving external control of file name or path, allowing an unauthorized attacker to execute code over a network.