CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Slican telephone exchanges allow administrative protocol authentication bypass. An attacker can bypass the need to enter login credentials by executing the appropriate command.
CVE-2026-42761 describes an improper neutralization of special elements used in SQL commands, allowing for Blind SQL Injection in the Active Products Tables for WooCommerce plugin in versions from n/a to 1.0.9.
CVE-2026-42758 describes an incorrect privilege assignment vulnerability in WebinarIgnition that allows privilege escalation. This issue affects WebinarIgnition from n/a through below 4.08.253.
CVE-2026-42757 describes an improper limitation of a pathname to a restricted directory, leading to a 'Path Traversal' vulnerability in the WebinarIgnition application. This issue affects versions from n/a to below 4.08.253.
The 'Path Traversal' vulnerability in Ludwig You QuickWebP has an improper limitation of a pathname to a restricted directory, allowing unauthorized access to files. This issue affects QuickWebP versions from n/a through 3.2.7.
CVE-2026-42755 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in RealMag777 TableOn versions from n/a to 1.0.5.1.
The vulnerability in WPify Woo Czech allows unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server. This issue affects WPify Woo Czech from n/a through 5.4.1.
CVE-2026-42747 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in Easy Form Builder. This issue affects versions from n/a through 4.0.6.
CVE-2026-42740 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in the Tainacan system. This issue affects Tainacan versions from n/a through 1.0.3.
CVE-2026-42731 describes an incorrect privilege assignment vulnerability in miniOrange OTP Verification that allows privilege escalation. This issue affects versions from n/a through 5.4.9 inclusive.
CVE-2026-42727 describes an improper neutralization of special elements used in SQL commands, allowing for Blind SQL Injection in the Active Products Tables for WooCommerce plugin in versions from n/a to 1.0.8.
In dotCMS Core versions 25.11.04-1 through 26.04.28-02, there is an SQL Injection vulnerability in the Publish Audit API endpoints, allowing remote unauthenticated attackers to read, modify, or destroy arbitrary database content.
Access control failure allows unauthorized users to access system data, including viewing and modifying configuration information.
W podatności CVE-2025-12686 występuje błąd przepełnienia bufora w AdminCenter systemu operacyjnego Synology BeeStation przed wersją 1.3.2-65648. Umożliwia on zdalnym atakującym wykonanie dowolnego kodu poprzez nieokreślone wektory.
The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to and including 1.6. This is due to an incomplete fix for CVE-2024-11178, allowing attackers to brute-force the 6-digit OTP without a time limit.
The HTTP::Daemon library for Perl before version 6.17 has an OS command injection vulnerability in the send_file() function. It opens its string argument with Perl's 2-arg open(), which interprets magic prefixes like '| cmd' as a pipe to a subprocess, allowing arbitrary command execution.
Cross-Site WebSocket Hijacking vulnerability in Dozzle prior to 10.5.2. The WebSocket upgrader for /exec and /attach endpoints accepts requests from any origin, and the JWT cookie uses SameSite: Lax. An attacker on the same site (e.g., a subdomain) can hijack the WebSocket session and gain interactive shell access to a container.
GitLab MCP Server before version 0.6.0 lacks authentication in HTTP transport and uses Access-Control-Allow-Origin: *, allowing anyone to access the RPC endpoint with full access to the GitLab personal access token. The server listens on all network interfaces.
Lumiverse prior to 0.9.7 has a vulnerability in the component override system that transpiles TSX via Sucrase and executes it with new Function, shadowing dangerous globals. Static protection and shadowing are bypassed by reconstructing identifiers from string fragments and DOM sandbox escape. A malicious theme pack (.lumitheme) can execute code in an authenticated user's session.
Vulnerability in Lumiverse (AI chat app) before version 0.9.7 allows a logged-in user to execute arbitrary code on the server via the MCP server creation endpoint. The attacker can use -e or -c flags in args, leading to remote code execution. The server listens on all interfaces and host-header rebinding protection is easily bypassed.