CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Joomla extension RO CSVI (rolandd.com) before version 9.11.0 allows unauthenticated attackers to create directories on the server.
Joomla Extension Gridbox below version 2.20.2 has a vulnerability allowing an authenticated attacker to upload arbitrary files. Combined with CVE-2026-65884, it can lead to remote code execution (RCE).
Streamsoft Business Intelligence (BI) stores user passwords in plaintext in the database. This issue was fixed in version 6.8.0.0, and users were requested to change their password on first login.
open-iscsi has an Incorrect Authorization vulnerability that allows unprivileged local users to use the iscsiuio control socket. The issue affects versions up to 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.
CWE-522 Insufficiently Protected Credentials vulnerability allows a local privileged attacker to bypass authentication and modify credentials, potentially leading to compromise of managed devices.
CWE-787 Out-of-bounds write vulnerability in IGSS Definition can cause data loss or potential arbitrary code execution when importing a malicious CGF file.
The Extra Checkout Options plugin for WordPress up to version 2.3.2 allows authenticated users with Subscriber-level access and above to upload PHP files. Missing authorization and nonce validation in the eco_save_settings() function enables modification of allowed file types, followed by PHP file upload via the frontend, leading to remote code execution.
GNU Bison allows arbitrary program execution during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for XML-to-HTML transformation via %define tool.xsltproc, which is accepted without restriction and passed directly to execvp(). Running bison --html on an attacker-provided grammar enables execution of an arbitrary program with the privileges of the Bison process.
In the BFD library of GNU binutils, the DLX ELF backend's dlx_rtype_to_howto() function lacks bounds checking, allowing out-of-bounds write. A crafted ELF/DLX file can lead to arbitrary code execution.
The Fluent Forms plugin for WordPress up to version 6.2.7 has a Stored XSS vulnerability via the Name field nested in `password`. An unauthenticated attacker can inject arbitrary JavaScript that executes when a user views the page.
The GTM4WP plugin for WordPress up to version 1.22.3 has a Stored XSS vulnerability via WooCommerce billing fields. An unauthenticated attacker can inject JavaScript in the billing first name during guest checkout.
SQL injection vulnerability in ERPNext and Frappe due to direct string interpolation in SQL queries. An authenticated low-privilege user can execute arbitrary SQL, bypass access controls, and extract sensitive data including admin password hash.
Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification. Affects versions from 8.0.0 through 10.1.3.
Several experimental plugins in Apache Traffic Server have memory-safety and limit-bypass errors. Affects versions from 8.0.0 through 10.1.3.
The webp_transform plugin of Apache Traffic Server can unsafely decode WebP images and serve mislabeled, cacheable responses. Affected versions: 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.
The header_rewrite plugin of Apache Traffic Server can crash or corrupt memory during cookie operations and CIDR condition matching. Affected versions: 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.
The ts_lua plugin of Apache Traffic Server mishandles initialization, transform context, and per-instance state. Affected versions: 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.
The uri_signing and url_sig plugins of Apache Traffic Server can exhaust the stack or crash on attacker input. Affected versions: 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.
The txn_box plugin of Apache Traffic Server overflows the stack from attacker-controlled input. Affected versions: 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.
The regex_remap plugin of Apache Traffic Server overflows the stack and integers from substitution input. Affected versions: 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.