CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SGLangs multimodal generation runtime is vulnerable to an unauthenticated path traversal vulnerability, allowing an attacker to write arbitrary files anywhere the server process has write access by including ../ sequences in the upload filename when sent to specific endpoints.
By default, the ROUTER socket in the SGLangs multimodal generation runtime scheduler binds to 0.0.0.0 and contains a sink that calls pickle.loads() on incoming messages, enabling remote code execution (RCE) when exposed to the internet.
Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to gain unauthorized access to protected features by manipulating the HTTP redirect headers of the login process.
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs. Password parameters in PKCS12.xs are declared char *, which leads to the loss of password length in Perl.
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws. When parsing a PKCS12 file with a >= 1 GiB OCTET STRING (or BIT STRING) attribute, a heap out-of-bounds write could be triggered, leading to remote-code-execution potential (RCE) due to a signed integer overflow in the size calculation passed to Renew().
The WordPress Plugin Peugeot Music version 1.0 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the upload.php endpoint. Attackers can upload files with arbitrary extensions by manipulating the 'name' parameter.
GitBucket version 4.23.1 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands. This is exploited through weak secret token generation and insecure file upload functionality.
ACL Analytics versions 11.x through 13.0.0.579 contain an arbitrary code execution vulnerability that allows attackers to execute arbitrary commands by leveraging the EXECUTE function.
The jsonpickle library version 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute arbitrary code.
libbabl version 0.1.62 contains a broken double free detection vulnerability that allows attackers to bypass memory safety checks by exploiting signature overwriting in freed chunks. Attackers can call babl_free() twice on the same pointer without triggering detection.
The iDS6 DSSPro Digital Signage System version 6.2 contains a CAPTCHA security bypass vulnerability. Attackers can retrieve valid CAPTCHA codes via the login endpoint and use them to perform brute-force attacks against user accounts.
In versions prior to 0.9.0 of the Open WebUI platform, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. The LdapForm Pydantic model accepts password as a string with no minimum length requirement, allowing an empty string to pass validation.
phpMyFAQ before version 4.1.2 contains an unauthenticated SQL injection vulnerability in the BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods. Attackers can exploit the public GET /api/captcha endpoint by injecting malicious User-Agent headers, leading to the leakage of sensitive data.
phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary user-id parameters without session binding or rate limiting. Unauthenticated attackers can brute-force any user's six-digit TOTP code by submitting POST requests with sequential token values, bypassing two-factor authentication to gain full administrative access.
The WordPress Plugin WP Super Edit version 2.5.4 and earlier contains an unrestricted file upload vulnerability in the FCKeditor component, allowing attackers to upload dangerous file types without validation.
A vulnerability in Traefik allows a user with HTTPRoute creation permissions in the Kubernetes Gateway API provider to bypass the providers.rest.insecure=false setting and access the REST provider handler. By accepting TraefikService backends with names ending in @internal, traffic can be routed to rest@internal, enabling unauthorized reconfiguration of routers and services in shared Gateway deployments.
The MCP Calculate Server, based on the MCP protocol and SymPy library, prior to version 0.1.1, used eval() to evaluate mathematical expressions without proper input sanitization, leading to remote code execution.
LibJWT is a C library for handling JSON Web Tokens. From versions 3.0.0 to 3.3.2, libjwt accepts an RSA JWK without the alg parameter as the verification key for HS256/HS384/HS512 tokens, allowing an attacker to forge a valid JWT without knowing any secret or RSA private key.
In Magento Long Term Support (LTS) versions prior to 20.18.0, the XML-RPC / SOAP API session ID is generated using an outdated time-based method, leading to low entropy levels. This violates OWASP ASVS and NIST standards, allowing attackers to perform brute-force attacks on active API sessions.
In OpenMRS, from version 2.7.0 to before 2.7.9 and 2.8.6, the ConceptReferenceRangeUtility.evaluateCriteria() method evaluates database-stored criteria as Apache Velocity templates without proper sandbox configuration. This allows unrestricted Java reflection through template expressions.