CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In SiSDK v2026.6.0 and earlier, high network traffic loads can cause a dropped ACK leading to a denial of service. This affects EFR32MG24 and EFR32MG26 devices running concurrent multiprotocol Zigbee and Thread.
Ceph versions prior to 20.2.4 and 19.2.6 use the CephX authentication protocol with AES-128-CBC in an unauthenticated mode, using a hard-coded initialization vector and no message authentication. An attacker with a low-privilege key can forge tickets and gain cluster-wide access, including to privileged components such as Manager, MDS, and OSD.
Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server. Fixed in Redis 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.
An unrestricted upload of file with dangerous type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission (routine Seller role) to execute arbitrary JavaScript in the application origin. The photo validation rule classifies the file only by its content (magic bytes) and rejects only a fixed list of PHP extensions, while ProductSaveController::save() names the stored file using the client-supplied extension and copies it into the public web root. A file that begins with an image header and carries an HTML extension passes validation, is stored under public/asset/upload/product/, and is served with a text/html content type, turning the upload into first-party stored script execution.
A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave stale size metadata after the profile buffer is freed. A subsequent allocation in the same decode can cause an out-of-bounds write, potentially crashing the application. To exploit this flaw, an application using gdk-pixbuf must process the malicious JPEG image. Affected version >= 2.26.4.
A path traversal vulnerability in the zip extraction functionality of AWS diagram-as-code (awsdac) versions 0.10 through 0.23 allows a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could enable unauthorized actions within the diagram bundle.
A weakness has been identified in RooCodeInc Roo-Code up to 3.51.1. Affected by this issue is the function ExecaTerminalProcess of the component README File Handler. Executing a manipulation can lead to code injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor no longer supports this project.
A security flaw has been discovered in RooCodeInc Roo-Code up to 3.51.1. Affected by this vulnerability is the function optimizeQuery of the file src/utils/helpers.ts of the component CodeIndexManager. Performing a manipulation results in code injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor no longer supports this project.
Frappe 15.11.0 through 16.32.0 stores and renders workspace card descriptions without XSS filtering. The description field is marked with ignore_xss_filter, and _sanitize_content() skips such fields, so the value is stored as submitted. It is then interpolated into a Bootstrap popover with html: true, allowing a user with the Workspace Manager role to execute arbitrary markup in the sessions of other desk users.
Dolibarr versions 9.0.0 through 23.0.4 save inbound email attachments under the name supplied in MIME headers without reducing it to a safe basename. The saveAttachment() functions in htdocs/emailcollector/lib/emailcollector.lib.php and htdocs/emailcollector/class/emailcollector.class.php build the file path from the attachment name, which may contain path traversal sequences, allowing writes outside the target directory.
Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() calls dol_check_secure_access_document() with mode 'read' instead of 'write', allowing an authenticated user with only read permissions to permanently delete module documents.
Dolibarr before 24.0.0 contains a SQL injection vulnerability in its CSV and XLSX import wizard. The wizard reads update keys via GETPOST('updatekeys', 'array') in htdocs/imports/import.php, applying only the generic alphanohtml filter that leaves SQL keywords, comment markers, parentheses, spaces, and quotes intact. The import_insert() function in htdocs/core/modules/import/import_csv.modules.php builds a filter with $where[] = $key.' = '.$data[$key] and executes it via $this->db->query(), allowing SQL injection.
A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material to be reproduced verbatim in the driver's human-readable diagnostic representation of client settings, instead of being masked as other secret fields are.
Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips it back into client configuration, the untrusted text is serialized without neutralizing URL/option delimiters and then re-parsed as authoritative connection options.
A MongoDB C# driver document-replacement code path omits the element-name/shape validation that equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements.
A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and query filter translation. Special elements in application-supplied values are not properly escaped before the query is sent to the database.
The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to influence that identifier may cause write operations to be applied to an unintended target within the same deployment.
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than intended.
A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application incorporating untrusted input into these names can have operations directed at a resource other than intended.
A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application.