CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') was identified in the Console WebUI of Waterfall WF-500 TX and RX Hosts version 7.9.1.0 R2502171040, allowing remote unauthenticated attackers to execute arbitrary operating system commands on the device.
A CWE-78 OS Command Injection vulnerability was identified in the Console WebUI of Waterfall WF-500 TX and RX Hosts version 7.9.1.0 R2502171040. It allows remote unauthenticated attackers to execute arbitrary operating system commands on the device.
A CWE-78 OS Command Injection vulnerability was identified in the Console WebUI of Waterfall WF-500 TX and RX Hosts version 7.9.1.0 R2502171040. It allows remote unauthenticated attackers to execute arbitrary operating system commands on the device.
A CWE-78 OS Command Injection vulnerability was identified in the Console WebUI of Waterfall WF-500 TX and RX Hosts version 7.9.1.0 R2502171040. It allows remote unauthenticated attackers to execute arbitrary operating system commands on the device.
A CWE-288 authentication bypass vulnerability in the Console WebUI of Waterfall WF-500 TX and RX hosts version 7.9.1.0 R2502171040 allows remote unauthenticated attackers to bypass authentication and perform actions as an authenticated user.
A CWE-78 OS Command Injection vulnerability was identified in the Console WebUI of Waterfall WF-500 TX and RX Hosts version 7.9.1.0 R2502171040. It allows remote unauthenticated attackers to execute arbitrary operating system commands on the device.
A CWE-78 OS Command Injection vulnerability was identified in the Console WebUI of Waterfall WF-500 TX and RX Hosts version 7.9.1.0 R2502171040. It allows remote unauthenticated attackers to execute arbitrary operating system commands on the device.
A CWE-78 OS Command Injection vulnerability was identified in the Console WebUI of Waterfall WF-500 TX and RX Hosts version 7.9.1.0 R2502171040. It allows remote unauthenticated attackers to execute arbitrary operating system commands on the device.
A CWE-23 Relative Path Traversal vulnerability in the Administration WebUI of Waterfall WF-500 TX and RX Hosts version 7.9.1.0 R2502171040 allows remote unauthenticated attackers to delete arbitrary files on the host machines.
A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions, allowing authenticated users with theme creation or upload permissions to achieve remote code execution (RCE) and access restricted system files and configuration.
The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor injection.
The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system access.
Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device.
Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requests when Base64 decoding fails.
The OTP Login With Phone Number, OTP Verification plugin for WordPress versions 1.8.50 through 1.8.60 contains an authentication bypass vulnerability. The Firebase verification flow in the `lwp_ajax_register` AJAX handler does not bind the Firebase session to the phone number supplied in the request, allowing attackers to authenticate as any user with a stored phone number, including administrators.
The WP Maps Pro plugin for WordPress up to version 6.1.0 contains a privilege escalation vulnerability via administrator account creation. Unauthenticated attackers can exploit the wpgmp_temp_access_ajax AJAX action, protected only by a nonce publicly embedded on every page, to create a new user with administrator role and take over the entire site.
An out-of-bounds write vulnerability in the GPU component of Google Chrome prior to version 148.0.7778.216 allows a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
A vulnerability in the Tint component of Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. The issue stems from an inappropriate implementation of the Tint mechanism.
A use-after-free vulnerability was found in Extensions in Google Chrome prior to 148.0.7778.216. A remote attacker who had compromised the renderer process could exploit a crafted Chrome Extension to potentially escape the sandbox.
A Use-After-Free vulnerability in the Base component of Google Chrome on Mac prior to version 148.0.7778.216 was discovered. A remote attacker could exploit a crafted HTML page to potentially perform a sandbox escape.