CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a session format mismatch between PHP and Node.js. This allows unauthenticated remote attackers to achieve root-level code execution by injecting crafted data into HTTP headers.
The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'piotnetforms_ajax_form_builder' function in all versions up to and including 2.1.40. The plugin uses an incomplete extension blacklist, allowing dangerous file uploads.
In the Linux kernel, a vulnerability was found in the pcrypt module that incorrectly handles MAY_BACKLOG requests. These requests can return EBUSY, which requires proper checking and filtering of EINPROGRESS notifications.
The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server.
CVE-2026-45434 in Apache OFBiz has a flaw in password-change logic that can lead to remote code execution. This issue affects versions before 24.09.06.
CVE-2026-41919 describes an improper neutralization of special elements used in LDAP queries, leading to LDAP Injection vulnerability in Apache OFBiz.
Use of hard-coded cryptographic key vulnerability in Apache OFBiz. This issue affects versions before 24.09.06.
In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine.
The Piotnet Addons for Elementor Pro plugin for WordPress up to version 7.1.70 has an arbitrary file upload vulnerability due to an incomplete extension blacklist – it only blocks php, phpt, php5, php7, and exe, but allows .phar and .phtml.
In the amazon-redshift-python-driver before version 2.1.14, the vector_in() function uses unsafe eval() on server-received data. This allows a rogue server or man-in-the-middle attacker to execute arbitrary code on the client. To remediate, upgrade to version 2.1.14.
Dokploy version 0.26.6 and below has an OS command injection vulnerability through the appName parameter due to inadequate input sanitization and shell interpolation.
WebdriverIO versions below 9.24.0 contain a command injection vulnerability leading to remote code execution (RCE) in test orchestration. Git permits branch names containing shell metacharacters, and getGitMetadataForAISelection() interpolates these names directly into execSync() calls without sanitization. An attacker can exploit this by supplying a malicious repository whose branch name carries a payload, causing arbitrary code execution on CI/CD servers and developer machines.
A vulnerability was found in lwIP up to 2.2.1 in the snmp_parse_inbound_frame function of src/apps/snmp/snmp_msg.c in the SNMPv3 USM handler. Manipulating the msgAuthenticationParameters argument results in a stack-based buffer overflow. The attack can be initiated remotely. A patch named 0c957ec03054eb6c8205e9c9d1d05d90ada3898c is available.
A path traversal vulnerability in DumbAssets through version 1.0.11 in the POST /api/delete-file endpoint and filesToDelete array parameters allows unauthenticated attackers to delete arbitrary files by supplying ../ sequences that bypass directory boundary validation. Attackers can exploit the optional and disabled-by-default authentication control to traverse outside the intended application directory and delete critical files such as server.js or package.json, causing complete denial of service.
Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges over a network.
In NOVUS AirGate 4G firmware version 1.1.16, the /uci/get/ endpoint suffers from incorrect access control. This allows unauthenticated attackers to obtain administrator credentials via a crafted POST request.
A pre-authentication code injection vulnerability in ChromaDB Python (version 1.0.0 and later) allows an unauthenticated attacker to execute arbitrary code on the server by sending a malicious model repository with trust_remote_code set to true to the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.
Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API. Attackers can exploit insufficient URL path sanitization to access internal endpoints.
Dify before version 1.14.2 contains an authorization bypass vulnerability that allows authenticated editor users to set and enable trace configurations for any application regardless of tenant ownership. This vulnerability allows attackers to redirect all messages and responses from victim applications to attacker-controlled LLM trace providers.
SGLangs multimodal generation runtime is vulnerable to unauthenticated remote code execution when the --enable-custom-logit-processor option is enabled. Python objects loaded via dill.loads() will be deserialized without validation.