CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Turborepo, a build system for JavaScript and TypeScript codebases, is vulnerable to arbitrary code execution in versions from 1.1.0 to before 2.9.14 when run in untrusted repositories containing malicious Yarn configuration. Package manager detection executes yarn --version, which could lead to loading and executing code from .yarnrc.yml controlled by an attacker.
CVE-2026-2031 describes an improper access control vulnerability in several internal API endpoints for Google Cloud Application Integration prior to January 23, 2026. This allows a remote, unauthenticated attacker to disclose sensitive information and execute arbitrary code using specially crafted HTTP requests.
The diagram's export module is vulnerable to Path Traversal in the src attribute due to lack of HTML sanitization. An unauthenticated user could craft an HTML payload that could include local files from the server and display them in the generated PDF.
The PDF Export Module used in DHTMLX's Gantt and Scheduler products is vulnerable to Remote Code Execution due to lack of 'data' parameter sanitization. An unauthenticated attacker can inject malicious JavaScript code that is processed by Node.js and subsequently executed on the server.
A supply chain attack compromised the official installation packages of DAEMON Tools Lite in versions 12.5.0.2421 to 12.5.0.2434, distributed from the legitimate website daemon-tools.cc between April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's build or distribution infrastructure and trojanized three binaries.
The Form Notify plugin for WordPress is vulnerable to Authentication Bypass in versions up to 1.1.10. The issue arises from the plugin trusting user-controlled cookie data, allowing unauthenticated access to user accounts.
Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a remote attacker to perform unauthorized changes to the GPU configuration, potentially resulting in loss of availability.
HRConvert2 prior to version 3.3.8 has a vulnerability in the sanitizeString() function that does not remove backtick (`) and tab ( ) characters. As a result, user input can reach shell_exec(), allowing commands within filenames to be executed.
In PrestaShop, prior to versions 8.2.6 and 9.1.1, there is a Cross-Site Scripting (XSS) vulnerability in the back-office Customer Service view. An unauthenticated attacker can submit a malicious email address through the Contact Us form, leading to session hijacking and full back-office takeover.
A vulnerability in Crabbox prior to v0.12.0 allows environment variable exposure, leaking sensitive data like API tokens, cloud credentials, and broker tokens into remote command environments. Attackers with access to a malicious or compromised repository can exploit overly permissive environment variable allowlisting in repo-local Crabbox configuration.
Use after free in Mojo in Google Chrome prior to version 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
Use after free in UI in Google Chrome prior to version 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
In Fleet software, prior to version 4.81.0, a vulnerability in the installation process could allow arbitrary commands to be executed as root (macOS/Linux) or SYSTEM (Windows) on managed endpoints when an uninstall is triggered. A specially crafted software package could lead to unintended command execution.
SiYuan is a knowledge management system that prior to version 3.7.0 did not properly HTML escape names and versions in plugin.json files. As a result, malicious HTML could be executed in the user interface when a user opened the marketplace tab.
SiYuan is an open-source personal knowledge management system. In versions prior to 3.7.0, attribute view names are stored without HTML escape, leading to potential HTML injection and Node.js code execution in the renderer.
Gradient is a nix-based continuous integration system. In version 1.1.0, when GRADIENT_DISCOVERABLE=true, anyone who can reach /proto can register as a worker without any credentials, leading to unauthorized access to jobs from every organization.
SiYuan is a knowledge management system that prior to version 3.7.0 had an issue with handling the aria-label attribute. Due to improper URL decoding, it was possible to inject malicious HTML code, leading to unauthorized script execution.
The Note Mark application prior to version 0.19.4 does not enforce minimum length or entropy for the JWT_SECRET configuration value. It allows any base64-decodable secret, including secrets as short as 1 byte.
mdserver-web versions from 0.18.0 to 0.18.4 have an unauthorized remote command execution vulnerability in the /modify_crond and /start_task interfaces. The lack of authentication allows modification of default scheduled tasks and their execution, leading to RCE.
FileBrowser Quantum prior to versions 1.3.1-stable and 1.3.9-beta has a vulnerability that allows an attacker to use attacker-controlled path input to escape the intended shared directory. As a result, an unauthenticated attacker with a valid public share hash and delete permissions can delete arbitrary files outside this directory.