CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.20)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated SQL Injection vulnerability in Web Directory Free versions up to 1.7.13. An attacker can execute arbitrary SQL queries without authentication.
Broken Authentication vulnerability in OAuth Single Sign On (SSO) (OAuth Client) versions up to 7.0.0 allows an unauthenticated attacker to bypass authentication mechanisms.
SQL Injection vulnerability in WP Directory Kit versions up to 1.5.4 allows an unauthenticated attacker to inject malicious SQL code.
Remote Code Execution (RCE) vulnerability in QA Analytics versions up to 5.2.0.0 allows an unauthenticated attacker to execute arbitrary code on the server.
WebErpMesv2 versions up to 1.19 allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote Code Execution. Combined with open registration and broken role middleware, this chain is effectively unauthenticated RCE against any default installation.
Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass.
Flowise before 3.1.3 contains a remote code execution vulnerability in the Custom MCP node when CUSTOM_MCP_PROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments.
Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection.
Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques.
Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code by bypassing the pythonCodeValidator blocklist through obfuscation techniques.
Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and args parameters to puppeteer.launch(), allowing execution of arbitrary OS commands and arbitrary host file disclosure.
The vulnerability involves use of hard-coded credentials (CWE-798), exposure of sensitive information to an unauthorized actor (CWE-200), and improper access control (CWE-284).
The vulnerability is related to missing authentication for a critical function (CWE-306).
The vulnerability involves client-side enforcement of server-side security (CWE-602).
The vulnerability involves exposure of sensitive information to an unauthorized actor (CWE-200) and exposure of private personal information to an unauthorized actor (CWE-359).
The vulnerability is related to improper authentication (CWE-287).
The Link Factory WordPress plugin is a backdoor. Distributed as a 'homepage sentence publisher', it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key (except for the health check).
The Customer Email Verification for WooCommerce WordPress plugin before version 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the account of any registered user who has not yet confirmed their email address.
UpSnap, a wake on lan web app, versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in pb.HandlerInitSuperuser. An unauthenticated network-adjacent attacker can register the initial superuser account, receive a long-lived JWT, and pivot to root remote code execution.
PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the source document. Meta tags named pdf-webkit-KEY are converted to wkhtmltopdf command line options without an allow list, allowing override of module defaults and options passed to new.