CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Microsoft Authenticator has a vulnerability that allows an unauthorized attacker to disclose sensitive information over a network.
Valtimo is a business process automation platform with a vulnerability that allows remote code execution and credential exfiltration. Versions from 12.0.0 to before 12.32.0 for com.ritense.valtimo:document and from 13.0.0 to before 13.23.0 for com.ritense.valtimo:case and com.ritense.valtimo:contract are affected.
CVE-2026-20182 identifies an issue with the authentication mechanism in Cisco Catalyst SD-WAN Controller, Manager, and Validator that allows an unauthenticated attacker to bypass authentication and gain administrative privileges. An attacker could exploit this vulnerability by sending crafted requests to the system.
Gotenberg is an API for PDF files that prior to version 8.31.0 had a vulnerability in the downloadFrom and webhook features. The default deny-lists were bypassable, allowing unauthenticated attackers to access internal HTTP services.
Gotenberg is a PDF file API that, prior to version 8.31.0, did not validate keys in JSON objects sent to the /forms/pdfengines/metadata/write endpoint. Using a newline character in a JSON key allows for the injection of arbitrary ExifTool flags, leading to unauthenticated OS command execution.
A vulnerability in PyTorch Lightning versions 2.6.2 and 2.6.2 introduces functionality consistent with credential harvesting.
In the soundcloud-rpc application prior to version 0.1.8, a vulnerability allowed for local command execution on the user's machine through malicious SoundCloud track metadata. This metadata was trusted and forwarded to the Electron main process, enabling it to be rendered as raw HTML.
vCluster Platform prior to versions 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0 has a Stored XSS attack vulnerability via the name field of a templateRef. This can lead to the execution of arbitrary external scripts within the platform's browser context.
A vulnerability in Akilli Commerce software allows authorization bypass through a user-controlled key, leading to session hijacking.
There is an SQL injection vulnerability in Akilli Commerce software that allows for a Blind SQL Injection attack. This issue affects E-Commerce Website versions before 4.5.001.
The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 5.1.2. This is due to the plugin not properly verifying that a user is authorized to perform an action.
The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation due to missing authorization in all versions up to and including 5.1.2. This is due to missing nonce verification and capability checks in the iwar_save_recipe() AJAX handler.
The Career Section plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to and including 1.7 due to missing file type validation in the CV upload handler. This allows unauthenticated attackers to upload potentially executable files, enabling remote code execution.
The Burst Statistics – Privacy-Friendly WordPress Analytics plugin is vulnerable to Authentication Bypass in versions 3.4.0 to 3.4.1.1. The issue arises from incorrect return-value handling in the `is_mainwp_authenticated()` function, allowing unauthenticated attackers to impersonate an administrator.
Web::Passwd versions through 0.03 for Perl is vulnerable to remote code execution (RCE). This application is used for managing htpasswd files, and the user parameter is not validated or escaped, allowing for command injection.
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.8, unsanitized user input was passed to the DHCP configuration, allowing remote code execution as root on the underlying operating system.
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to version 16.9.1, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role.
In OPNsense, prior to version 26.1.8, there is a remote code execution (RCE) vulnerability that allows a user with user-management privileges to execute arbitrary system commands as root. An attacker can bypass input validation by formatting their malicious payload as a compliant email address.
OPNsense is a FreeBSD based firewall and routing platform. In versions prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input, leading to Remote Code Execution.
CubeCart prior to version 6.7.0 has an Authenticated Server-Side Template Injection (SSTI) vulnerability in multiple modules, including Email Templates, Invoices, Documents, and Contact Forms. The application unsafely evaluates user-supplied input, allowing authenticated users with administrative privileges to execute arbitrary operating system commands.