CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference (IDOR) that allows authenticated low-privileged attackers to overwrite any user's credentials by exploiting a parameter confusion flaw between the authorization filter and action body in the UsersController. Attackers can send a PATCH request to the updated_ajax endpoint setting params[:id] to their own user ID to pass the self-authorization check while simultaneously setting params[:user_id] to a victim's ID, causing the controller to load and mutate the victim's account, including overwriting administrator passwords to achieve full site takeover.
Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via local access.
Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another participant via network access.
Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution of another participant via network access.
TypeBot before version 3.17.0 allows a low-privilege guest member to exfiltrate stored OpenAI-compatible API keys by invoking the OpenAI model-listing helper with an attacker-controlled baseUrl. The vulnerable path decrypts the selected workspace credential and sends the outbound request to the caller-supplied URL, delivering the secret to attacker infrastructure. Version 3.17.0 patches the issue.
TypeBot before version 3.17.0 in the Google Sheets OAuth callback decodes a base64-encoded JSON `state` parameter and trusts the embedded values without cryptographic integrity protection or authorization checks. An authenticated user who can obtain a valid Google OAuth `code` can alter the `state` to create credentials in another workspace and attach them to a block in another Typebot. Version 3.17.0 patches the issue.
TypeBot before version 3.17.0 in the `handleGetSheets` API handler does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data. Version 3.17.0 fixes the issue.
A flaw was found in DBI, which is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. Detailed information is available in the original description on the Red Hat website.
The NewNotebook API does not sufficiently sanitize its parameters, allowing an authenticated user with NOTEBOOK_EDIT permission to write the notebook record outside the org's data store directory. The file written must have an extension of ".json.db" but can overwrite other metadata files, causing data corruption.
When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdPs allow users to change the email claim without verification, and some do not set the "email_verified" claim. This allows a user to impersonate another user by setting their email address within the IdP, enabling account takeover.
AutoGPT before 0.6.70 has a vulnerability in the webhook_ingress_generic route that does not verify the webhook provider, allowing bypass of signature verification and execution of a generic webhook as its owner.
SeaweedFS before 4.24 uses strings.HasPrefix for authorization checks, allowing a JWT scoped to /tenant1 to access sibling paths like /tenant1234, /tenant1-old, and /tenant1backup.
Velociraptor allows an administrator of a child org to delete other orgs because it checks the ORG_ADMIN permission in the calling org instead of the ROOT org.
Velociraptor before 0.77.2 evaluates the IMPERSONATE permission against the caller's org instead of the target org, allowing an administrator in one org to impersonate a user in another org.
Ivanti Endpoint Manager before 2024 SU7 transmits sensitive information in cleartext, allowing a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections.
Ivanti Endpoint Manager before 2024 SU7 has a vulnerability related to external control of a filename, allowing a remote authenticated attacker full write control over an S3 bucket configured for session recording storage.
Ivanti Endpoint Manager before 2024 SU7 has an out-of-bounds read vulnerability in the Agent, allowing a remote unauthenticated attacker to crash an agent service.
An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery (SSRF) via the Webhook validation mechanism in internal/webhook/validate.go, by setting a webhook target to an internal address.
Roskus Prospero Flow CRM before 5.4.9 has an authorization bypass through user-controlled key, allowing authenticated users of any company to read, hijack, and delete tickets belonging to another company.
Craft CMS versions from 5.0.0-RC1 before 5.10.7 and from 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism, allowing an authenticated attacker with control panel access to execute arbitrary code.