CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In versions prior to 3.3.8, the WebServer multipart form parser in arduino-esp32 allocates a Variable Length Array (VLA) on the stack whose size is derived from an attacker-controlled HTTP header field. Sending a boundary string longer than ~8000 characters overflows the stack and may lead to remote code execution.
django-s3file prior to version 7.0.2 is vulnerable to relative path traversal attacks, allowing an attacker to escape pre-signed upload locations and load files from random locations into request.FILES. This may lead to confidentiality and integrity issues.
Exim versions before 4.99.3, in certain GnuTLS configurations, has a use-after-free vulnerability in the BDAT body parsing path. This can lead to heap corruption when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection.
Pulpy is a lightweight, cross-platform application packager for web apps. Prior to version 0.1.1, Pulpy injected the pulpy.fs JavaScript API into every packaged web application, allowing access to the host filesystem. The validateFsPath() function was supposed to sandbox this access, but its blocklist was incomplete.
ArcadeDB versions 21.10.1 through 26.4.1 have two defects: (1) ServerSecurityUser.getDatabaseUser() returns a DB user with an uninitialized fileAccessMap, causing allow-all; (2) ArcadeDBServer.createDatabase() omits factory.setSecurity(...), disabling record-level authorization for new databases. An authenticated user or API token can read, write, and mutate schema on any other database on the same server.
Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. An unauthenticated attacker could access document contents if they know or guess a document ID.
Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page.
Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code.
WGDashboard, a dashboard for managing WireGuard VPN, prior to version 4.3.2 had critical vulnerabilities that could allow unauthorized parties to access the host file system without authentication.
An improper access control vulnerability exists in Fortinet FortiAuthenticator versions 8.0.2, 8.0.0, 6.6.0 through 6.6.8, and 6.5.0 through 6.5.6. This may allow an attacker to execute unauthorized code or commands via crafted requests.
In Pingvin Share X versions 1.14.1 to 1.16.2, a critical authentication bypass vulnerability allows an attacker with a valid username and password to completely skip the two-factor authentication (TOTP) requirement. This vulnerability is fixed in version 1.16.3.
CVE-2026-44183 affects the Cleanuparr tool, which automates the cleanup of unwanted files in Sonarr, Radarr, and supported download clients. In versions prior to 2.9.10, an attacker could exploit the X-Forwarded-For header to spoof the client IP address, allowing unauthorized access to the administrator account.
Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
Nieprawidłowa kontrola generowania kodu ('iniekcja kodu') w Microsoft Dynamics 365 (wersja lokalna) umożliwia autoryzowanemu atakującemu wykonanie kodu w sieci.
Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.
DevGuard prior to version 1.2.2 accepts a client-supplied X-Admin-Token HTTP request header and uses its raw string value as the authenticated userID when no Kratos session cookie is present. This allows an unauthenticated attacker to issue requests as that user, potentially taking control of the organization's resources.
Langflow, a tool for building and deploying AI agents, is vulnerable to Path Traversal in the Knowledge Bases API (DELETE /api/v1/knowledge_bases) prior to version 1.9.0. An attacker can exploit this flaw to delete arbitrary directories on the server.
Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira and Confluence allows an unauthorized attacker to elevate privileges over a network.
A heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.
Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.