CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In certain scenarios when the admin has enabled Interactive Connectivity Establishment (ICE), a buffer overflow could enable remote code execution on Poly Voice products on the Linux platform.
A Deserialization of Untrusted Data vulnerability in Teamwork Cloud and Magic Collaboration Studio from No Magic Release 2022x through 2026x and CATIA Magic Release 2022x through 2026x could lead to unauthenticated remote code execution.
Apache Airflow documentation contained a `BashOperator` code example without proper quoting, allowing shell metacharacter injection via the `conf` field in the DAG trigger API. An authenticated user with `Dag.can_trigger` permission could execute arbitrary commands on the worker.
An improper input validation vulnerability in the database layer module of OTRS and ((OTRS)) Community Edition allows an unauthenticated SQL injection, which can lead to authentication bypass. This issue only affects systems where the MySQL/MariaDB server is configured with the NO_BACKSLASH_ESCAPES SQL mode.
Totolink N300RH router with firmware 6.1c.1353_B20190305 has a stack-based buffer overflow vulnerability in the setWiFiBasicConfig function of the wireless.so file. An attacker can exploit this remotely via the KeyStr argument.
Delta Sql 1.8.2 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious PHP files via POST to docs_upload.php. These files can then be executed on the server, leading to remote code execution.
FreeRDP prior to 3.26.0 has an out-of-bounds heap write in the planar bitmap decoder. An attacker can bypass coordinate validation and write past the internal buffer.
Formie, a Craft CMS plugin, prior to versions 2.2.20 and 3.1.24 allows unauthenticated users to submit crafted values into Hidden fields that are evaluated as Twig during submission handling. This can lead to serious compromise of the Craft site.
The cpp-httplib library before version 0.44.0 improperly validates HTTP headers, allowing injection of newline characters via encoded header values.
An authentication bypass vulnerability in the NI SystemLink Enterprise Dashboard application. An unauthenticated remote attacker can bypass authentication controls, leading to privilege escalation or information disclosure.
Shopper, a Headless e-commerce Admin Panel prior to 2.8.0, contains two authorization defects in team settings. These allow any authenticated user to take over the RBAC system, create new roles, delete other users (including administrators), and escalate privileges to full panel administrator.
SillyTavern before version 1.18.0 has a vulnerability in the POST /api/extensions/delete endpoint that allows deletion of the entire user extensions directory by sending extensionName "." (dot). The sanitize-filename validation is bypassed, and no authentication is required in the default configuration.
SillyTavern, a locally installed user interface, accepts Remote-User and X-Authentik-Username HTTP headers for automatic login when SSO is configured, without validating they originate from a trusted proxy.
The firmware of the USR-W610 RS232/485 Wi-Fi/Ethernet Converter by Jinan USR IOT Technology Limited (PUSR) contains plaintext administrative credentials embedded in the firmware image. These credentials can be extracted through firmware analysis and used to authenticate to device services.
A critical unauthenticated password reset vulnerability in KMW CCTV Security Cameras. An attacker can remotely reset the administrator password to a known value without authentication, gaining full access to camera feeds and settings.
Trilium Notes is a cross-platform hierarchical note-taking application. Prior to version 0.102.2, a malicious ZIP archive imported with safe import enabled achieves RCE via #docName path traversal and XSS. It combines a payload note (type: code, mime: text/plain) containing raw HTML/JS and a trigger note (type: doc or launcher) with a #docName label using ../ path traversal to point at the payload note's API endpoint. The desktop client Electron runs with nodeIntegration enabled, so RCE is triggered once the payload is executed. This vulnerability is fixed in version 0.102.2.
A critical path traversal vulnerability in Dokploy 0.26.5 and earlier. Authenticated users can write arbitrary files during deployment, which combined with remote server feature enables remote code execution and full server compromise.
Dokploy in version 0.26.6 and earlier has a command injection vulnerability in the /docker-container-logs WebSocket endpoint. The tail and since parameters are not validated and are directly concatenated into shell commands, allowing authenticated users to execute arbitrary commands with root privileges.
Dokploy in 0.26.7 and earlier does not enforce organization/role checks in the schedule router. Any authenticated user can create, update, run, or delete schedules of other organizations if they know the scheduleId/serverId. Schedule types server and dokploy-server enable code execution on the host or remote server (RCE).
Dokploy versions 0.27.0 through 0.29.3 contain a hardcoded BETTER_AUTH_SECRET fallback ("better-auth-secret-123456789"), allowing an unauthenticated attacker to forge email verification JWTs, trigger auto-sign-in as admin, and execute commands on the host via the built-in SSH terminal.