CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.20)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The All in One SEO WordPress plugin before version 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state.
A vulnerability was found in hunvreus devpush up to version 0.4.6 in the reset_storage function of the file app/workers/tasks/storage.py. The issue involves improper check or handling of exceptional conditions, which could lead to unexpected behavior.
A vulnerability in django-blog-zinnia up to version 0.20 stores protected entry passwords in cleartext within the file zinnia/views/mixins/entry_protection.py. The issue affects the Protected Entry Password Handler component and requires local access to exploit. The project has not responded to the report.
A race condition vulnerability was found in the Hostname Allocation Handler component of the allegro project (up to version bcf65b994ef29fb3fc2e10b660e6288723d5209e) in the AssetLastHostname.increment_hostname function. The attack requires manipulation of the counter argument, is highly complex, and considered difficult to exploit. The exploit has been publicly disclosed and may be used, while the project has not responded to the issue report.
A vulnerability was found in django-tastypie up to version 0.15.1 in the ApiKeyAuthentication function within tastypie/authentication.py. The issue involves using the GET method with sensitive query strings, potentially leaking API keys. The attack is remote but has high complexity and is considered difficult to exploit.
A cross-site scripting vulnerability has been found in Pluck CMS up to version 4.7.21 in the Albums module. The htmlspecialchars_decode function in data/modules/albums/albums.admin.php mishandles the Info argument, allowing remote injection of malicious scripts. The exploit is public, and the project has not responded to the report.
A cross-site scripting vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the /forCYS.php file. Manipulation of the course argument allows remote injection of malicious scripts. The exploit is publicly available.
A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0, allowing XSS in /CYS.php via the course argument. The attack is remotely exploitable and the exploit is public.
A cross-site scripting vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the file /forexam.php. Manipulating the day argument allows remote script execution. The exploit has been publicly disclosed.
A cross-site scripting vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the file /schoolyr.php. Manipulating the sy argument allows remote script execution. The exploit has been publicly disclosed.
In Feathersjs version 5.0.44 and earlier, the _.merge function in @feathersjs/commons allows prototype pollution via __proto__, constructor, or prototype keys from JSON.parse.
Statamic CMS prior to versions 5.74.0 and 6.20.3 has a vulnerability in the Live Preview endpoint that only checks view authorization but accepts and renders caller-supplied field values. A Control Panel user with view but not edit permission can submit unauthorized content and generate a shareable Live Preview URL.
IBM Verify Identity Access and IBM Security Verify Access contain an open redirect vulnerability that allows a remote attacker to conduct phishing attacks by using a specially crafted request to redirect a victim to arbitrary websites.
Vulnerability in oras-go library before version 2.6.1. The auth client follows the realm URL from a registry without validation, enabling SSRF attacks to internal networks such as http://169.254.169.254/.
A vulnerability in IBM PowerVM Novalink arises from API misconfiguration, which under non-default conditions may increase the attack surface and enable unintended or unauthorized operations.
In the RustCrypto CMOV library versions 0.1.1 through 0.5.4, the aarch64 implementations of Cmov and CmovEq assume high bits are zero-extended when loading values smaller than a register, which can lead to incorrect results of the cmovz operation.
The Star.text_to_image/NetworkRenderStrategy.render function in the file astrbot/core/star/base.py in AstrBot up to version 4.25.2 is vulnerable to XSS. The attack can be performed remotely and the exploit is publicly available. The vendor did not respond.
The HCL DFMPro, DFXAnalytics and DFXServer installers are affected by an insecure file permissions vulnerability that allows any logged-in non-administrative user to overwrite or replace the executable file with a malicious binary.
The vulnerability in HCL DevOps Loop is caused by insufficient input validation, allowing special characters where they should be restricted. This may result in unintended application behavior under certain conditions.
HCL DevOps Loop is missing HTTP security headers, which reduces browser protections against common web-based attacks such as clickjacking, MIME-type sniffing, and cross-site scripting.