CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ahmad WP Job Portal allows Blind SQL Injection. This issue affects WP Job Portal from n/a through 2.5.1.
In Wirtualna Uczelnia up to version wu#2016.437.295#0#20260327_105545, a Server-Side Template Injection (SSTI) vulnerability in the redirectToUrl endpoint allows an unauthenticated attacker to achieve remote code execution, including a reverse shell.
Incorrect privilege assignment in Themeisle's Masteriyo LMS PRO allows privilege escalation.
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress versions 6.0.0 to 6.0.6 is vulnerable to privilege escalation via account takeover. The plugin accepts an arbitrary email address when a username is used in the password reset request, allowing unauthenticated attackers to send a password reset link to their own email.
Langroid SQLChatAgent before version 0.63.0 executes SQL generated by an LLM, which is influenceable by prompt injection. An attacker can coerce execution of dangerous operations like COPY ... FROM PROGRAM, leading to remote code execution on the database host.
Cloud Foundry UAA versions v76.12.0 through v78.12.0 inadvertently expose EC private keys through the public /token_keys endpoint. The vulnerability affects only deployments using EC keys for JWT token signing.
Arm Whois 3.11 has a stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code by supplying oversized input to the IP address or domain field. Attackers can craft malicious input exceeding 658 bytes with shellcode to overwrite the structured exception handler and gain command execution.
IBM WebSphere Application Server 9.0 and 8.5 are vulnerable to remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security.
IBM WebSphere Application Server 9.0 and 8.5 is vulnerable to remote code execution caused by the bypass of security controls.
IBM WebSphere Application Server 9.0 and 8.5 is vulnerable to identity spoofing.
Vulnerability in Capsule, a multi-tenancy and policy-based framework for Kubernetes. The Capsule Controller runs with cluster-admin privileges. TenantResource RawItems processing incorrectly handles cluster-scoped resources, allowing tenant administrators to create cluster-scoped resources (e.g., ClusterRole, ValidatingWebhookConfiguration) with elevated privileges, leading to cross-tenant privilege escalation and cluster-level attacks. Version 0.13.0 patches this issue.
In CloudPirates Open Source Helm Charts prior to commit fcf9302, a GitHub Actions workflow (generate-schema.yaml) exposes sensitive credentials (Personal Access Token and SSH signing key) to fork-controlled code due to unsafe checkout and credential handling.
In CloudPirates Open Source Helm Charts prior to commit fcf9302, a GitHub Actions workflow (pull-request.yaml) executes attacker-controlled code from forks in a privileged context, exposing repository secrets including Docker Hub credentials.
Cline is an autonomous coding agent available as an SDK, IDE extension, or CLI assistant. In versions 2.13.0 and prior, there is a cross-origin WebSocket hijack vulnerability in Cline Kanban servers. At the time of publication, no public patches are available.
The WP Directory Kit plugin for WordPress is vulnerable to Blind SQL Injection due to improper neutralization of special elements in SQL commands.
A critical Remote Code Execution (RCE) vulnerability in Disig Web Signer versions 2.0.3 through 2.5.3. Allows an attacker to execute arbitrary code remotely on the server.
The AIWU WordPress plugin contains an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects versions from n/a through 1.4.17.
A Path Traversal vulnerability in Gravity Forms by Rocketgenius Inc. allows access to files outside the restricted directory. This issue affects versions up to 2.10.0.1 inclusive.
The wpForo Forum plugin for WordPress has missing authorization, allowing exploitation of incorrectly configured access control security levels.
The Contest Gallery Pro WordPress plugin contains an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects versions from n/a through 29.0.1.