CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.20)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In Appsmith prior to version 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-controlled smtpHost and smtpPort values and establishes a raw JavaMail TCP connection without IP validation. This completely bypasses WebClientUtils.IP_CHECK_FILTER, which only applies to Spring WebClient HTTP requests. Additionally, the raw MailException.getMessage() is returned verbatim in the API error response, enabling error-based internal port scanning and service banner enumeration.
In Cacti versions 1.2.30 and below, the locale-dependent decimal formatting in rrdtool_function_update() can corrupt RRDtool metric values. When the server locale uses comma as decimal separator (e.g., de_DE), a value of 1.5 becomes '1,5', while RRDtool expects a dot. This causes metric data to shift into wrong columns or be silently dropped.
Gogs is an open source Git service that prior to version 0.14.3 was vulnerable to a panic error when rendering a specially crafted issue index pattern, resulting in denial of service.
Vulnerability in Rocket.Chat before versions 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12 where OAuth bearer or refresh tokens are not revoked when a user is deactivated. A deactivated user can continue using an existing access token or mint a fresh token from a refresh token.
Rocket.Chat prior to versions 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12 allowed users deactivated through users.deactivateIdle to continue using already-issued login tokens. A user marked inactive by an administrator could still access authenticated REST endpoints with the old token.
Jellyfin prior to version 10.11.10 has a vulnerability that allows a specially crafted MKV file with forged filename tags to exploit missing path sanitization during playback. As a result, a malicious MKV file can redirect attachment extraction to any absolute path on disk.
Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowing unauthenticated attackers to inject LDAP wildcard characters to enumerate directory entries and to authenticate as a matching user whose password they know without knowing their exact user name.
A vulnerability in ImageMagick before version 7.1.2-19 allows out-of-bounds access in the ConnectedComponentsImage() function when processing connected-components artifacts with invalid indices. Attackers can trigger access violations via CLI, leading to denial of service or potential code execution.
A memory leak vulnerability in ImageMagick before version 7.1.2-15 exists in multiple coders that write raw pixel data, where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, leading to memory exhaustion and denial of service.
CVE-2026-13140 involves stored Cross-Site Scripting in the exposed AWS API key store of Thinkst Applied Research Canarytokens. Anonymous exploitation requires knowledge of a random identifier.
The Site Kit by Google WordPress plugin before version 1.176.0 does not properly restrict a REST API write endpoint to administrators, allowing lower-privileged users (such as Editors) to modify a site-wide setting that should only be modifiable by administrators.
NocoDB prior to version 2026.05.1 allowed low-privilege users to read files in shared storage, including attachments belonging to other bases and workspaces, if they knew the attachment path. This issue was due to the MCP readAttachment tool not verifying file ownership.
NocoDB, software for building databases as spreadsheets, had an issue with deleting API tokens. Prior to version 2026.04.4, deleted tokens continued to authenticate requests until their cache entry expired.
NocoDB is software for building databases as spreadsheets. Prior to version 2026.04.1, the upload-by-URL path did not enforce the NC_ATTACHMENT_FIELD_SIZE limit, allowing an authenticated user to bypass the configured per-file size limit.
In NocoDB prior to version 2026.04.1, an OAuth token with a restricted scope (e.g., MCP-only) inherited full user permissions across all routes. The granted_resources.base_id restriction was bypassed on org-level endpoints that do not populate req.context.base_id.
Pi, a minimal terminal coding harness, from version 0.74.0 to 0.78.1 stores API keys and OAuth credentials in auth.json. A race condition in the file write path could briefly create or rewrite this file with permissions derived from the process umask before tightening the file to owner-only permissions.
Pi is a minimal terminal coding harness. In versions from 0.74.0 to 0.78.1, HTML exports did not consistently reject unsafe Markdown link and image URL schemes, potentially leading to security vulnerabilities.
Vulnerability in the CMS parser in gpgsm of GnuPG (up to version 2.5.20) mishandles the CMS format for AES-GCM encryption. The aes-ICVlen field should be 12 bytes but 4 bytes is also accepted, which may lead to errors in data integrity verification.
In GNU SASL before version 2.2.4, there is a lack of sanitization of a short challenge in the _gsasl_ntlm_client_step function in the NTLM client, which could result in memory disclosure via a crafted server.
A broken access control vulnerability in HCL Connections may allow an unauthorized user to view data in a single specific scenario.