CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In an SSH library (likely Go), a malicious SSH peer can send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine cannot be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.
A cross-site scripting (XSS) vulnerability in SketchUp 2026's Dynamic Components feature allows remote code execution and local file exfiltration through maliciously crafted SKP files. The vulnerability stems from improper input sanitization in the component options window, enabling attackers to execute arbitrary system commands and read local files without user interaction by exploiting an embedded Internet Explorer 11 browser.
Command Injection vulnerability in UniFi OS devices. Improper input validation allows an attacker with network access to execute arbitrary system commands.
Path Traversal vulnerability in UniFi OS devices. An attacker with network access can read system files and potentially gain access to a user account.
Improper Access Control vulnerability in UniFi OS devices. An attacker with network access can make unauthorized changes to the system.
A malicious actor with network access and high privileges can exploit an Improper Input Validation vulnerability in UniFi OS devices to execute a Command Injection.
An arbitrary file upload vulnerability in the BookingPress Pro plugin for WordPress up to version 5.6. Missing file type validation in the 'bookingpress_validate_submitted_booking_form_func' function allows unauthenticated attackers to upload arbitrary files to the server.
Apache Fory PyFory before version 1.0.0 has a deserialization vulnerability in ReduceSerializer that can bypass DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data in Python-native mode with strict mode disabled.
The WP Directory Kit plugin for WordPress up to version 1.5.0 is vulnerable to blind SQL injection. An attacker can send malicious SQL queries through improperly sanitized input parameters.
A vulnerability in the Trend Micro Apex One management console (similar to CVE-2025-71210 but affecting a different executable) allows a remote attacker to upload malicious code and execute commands. Requires access to the management console. SaaS versions are already patched.
A vulnerability in the Trend Micro Apex One management console allows a remote attacker to upload malicious code and execute commands. Requires access to the management console. SaaS versions are already patched.
The Divi Form Builder plugin for WordPress up to version 5.1.2 allows privilege escalation. It accepts a user-controlled 'role' parameter from POST data during registration without validating it against the form's default_user_role setting, enabling unauthenticated attackers to create administrator accounts.
In the Linux kernel, a vulnerability exists in handling the IPv6 Source Routing Header (SRH). During decompression and recompression of SRH, if the recompressed header is larger than the received one, an out-of-bounds write can occur in ipv6_rthdr_rcv. The issue arises when headroom is insufficient, leading to memory corruption.
The Honeywell Control Network Module (CNM) contains a command injection vulnerability in the web interface, exploitable by an attacker via command delimiters, potentially leading to remote code execution (RCE).
A heap-based buffer overflow in the CNID daemon in Netatalk (versions 2.0.0-4.4.2) allows a remote authenticated attacker to execute arbitrary code with elevated privileges or cause a denial of service.
The Avada Builder (fusion-builder) plugin for WordPress up to version 3.15.2 is vulnerable to unauthenticated remote code execution via PHP function injection. The vulnerability allows attacker-controlled values from a base64-decoded JSON blob to be passed directly to call_user_func() without validation. Exploitation is possible through the fusion_get_widget_markup AJAX endpoint, which is accessible to unauthenticated users, and the nonce is deterministically exposed on public pages.
Altium 365 SearchService lacks authentication in a legacy SOAP endpoint, allowing an unauthenticated attacker to read the search index (component data, project names, user metadata) and inject, modify, or delete index entries. Affects Altium 365 cloud deployments.
Privilege escalation vulnerability in LiteSpeed User-End cPanel Plugin before version 2.4.5. An attacker can gain root privileges. The vulnerability is being actively exploited in the wild.
Vulnerability in the Crypt::SaltedHash library for Perl (versions up to 0.09) uses the built-in rand function for salt generation. This function is predictable and unsuitable for cryptographic purposes, allowing an attacker to reproduce the salt.
A vulnerability in HP Linux Imaging and Printing Software allows privilege escalation and remote code execution via an integer overflow in the hpcups processing path when handling crafted print data.