CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The ProSolution WP Client plugin for WordPress up to version 2.0.0 has an arbitrary file upload vulnerability due to array validation mismatch – only the first file is validated, but all are uploaded.
Missing authorization in the Date iCal module for Drupal allows forceful browsing, enabling unauthorized access to resources. Affects versions before 4.0.15.
CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the web-based installer (public/installer/index.php) is vulnerable to unauthenticated Remote Code Execution (RCE) because it performs the install.lock check only after including and executing form handler files, leaving installer endpoints reachable on already-installed instances. The handlers also pass unsanitized user input directly into shell commands, allowing an attacker to submit crafted requests that execute arbitrary commands on the server. The vulnerability stems from two combined weaknesses: (1) premature form handler execution before the lock file gate, and (2) unsafe use of user input in shell command construction. This issue is reported to be actively exploited in the wild. The issue has been fixed in version 1.2.0.
Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kitty/graphics.c performs bounds validation on composition offsets using unsigned 32-bit arithmetic that is subject to integer wrapping, potentially leading to Heap Buffer Over-Read/Write. An attacker who can write escape sequences to a kitty terminal (e.g., via a malicious file, SSH login banner, or piped content) can supply crafted x_offset/y_offset values that pass the bounds check after wrapping but cause massive out-of-bounds heap memory access in compose_rectangles(). No user interaction is required. No non-default configuration is required. The attacker only needs the ability to produce output in a kitty terminal window. This issue has been fixed in version 0.47.0.
In ScadaBR version 1.2.0, use of hard-coded credentials allows an attacker to access the SCADA system as admin.
ScadaBR version 1.2.0 contains an OS command injection vulnerability. An attacker can execute arbitrary commands as root on the SCADA system.
ScadaBR version 1.2.0 has a missing authentication for critical function vulnerability, allowing an unauthenticated attacker to send HTTP GET requests to the SCADA system and inject arbitrary sensor readings.
The embedded HTTP server in Panabit PAP-XM320 up to version 7.7 fails to validate session cookie values, allowing authentication bypass via directory traversal.
An OS command injection vulnerability in the /stream-to-vlc Express route in hitarth-gg Zenshin before 2.7.0 allows remote attackers to execute arbitrary commands via the url parameter.
APScheduler in all versions (including 3.10.x and 4.0.0a5) is vulnerable to Remote Code Execution (RCE) via insecure deserialization in JSONSerializer and CBORSerializer. The unmarshal_object function allows arbitrary class instantiation and state injection by dynamically importing modules and calling __setstate__ on any available Python class.
API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication middleware. Unauthenticated remote attackers can exploit this to dump all user records (including bcrypt password hashes) via /api/user/getUserData, modify drug inventory, and access private medical prescription data via /api/doctorOder.
LalanaChami Pharmacy Management System (commit 5c3d028) allows unauthenticated attackers to escalate privileges by self-assigning an administrative role during registration. The /api/user/signup endpoint does not validate the role parameter.
scalar/astro v0.1.13 contains an SSRF vulnerability in the scalar_url parameter of the Scalar Proxy endpoint. Unauthenticated attackers can force the backend server to send HTTP requests to attacker-controlled URLs.
In scalar/astro v0.1.13, an arbitrary file upload vulnerability exists via the scalar_url parameter of the Scalar Proxy endpoint. An attacker can upload a crafted SVG file, leading to arbitrary code execution.
Tyler Identity Local (TID-L) uses documented, default administrative credentials. Users are not required to change credentials before deployment. The product has not been distributed since December 2020 and is unsupported since 2021.
A critical remote code execution vulnerability in the server-side template rendering mechanism used by the Glassfish gadget handler allows an attacker to inject EL expressions, leading to full host compromise.
An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of the application service user. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.
CVE-2026-8959 is a vulnerability due to incorrect boundary conditions in the Widget: Win32 component, allowing for sandbox escape. It has been fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
Integer overflow in the Networking: JAR component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
A 'sandbox escape' vulnerability exists due to a use-after-free error in the Disability Access APIs component. It has been fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.