CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.20)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A use-after-free vulnerability in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
A deserialization of untrusted data vulnerability in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network.
A missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.
An OS command injection vulnerability in ColdFusion allows arbitrary code execution in the context of the current user. Exploitation requires no user interaction, and the scope is changed.
An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.
SeaweedFS before 4.24 has a vulnerability in the FetchAndWriteNeedle RPC that lacks authentication and target validation. An attacker can send requests to arbitrary hosts, including cloud metadata endpoints, and read the responses.
Twenty before 2.15.0 allows a workspace administrator with DATA_MODEL permission to supply an unescaped expression for the TS_VECTOR field, leading to SQL injection and arbitrary PostgreSQL execution as the application user.
Fooocus up to version 2.5.5 is vulnerable to remote code execution due to unsafe use of eval when processing metadata JSON. An attacker with web UI access can execute arbitrary code.
SeaweedFS before 4.24 registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filer_signing.key is unset. Any client with gRPC access can create users and access keys, gaining S3 administrative control.
TypeBot version 3.16.1 stores API tokens in the database as cleartext. An attacker with database read access can extract all tokens and impersonate any user without password or MFA.
SIMULIA Execution Engine from Release 2023 through 2026 has an untrusted data deserialization vulnerability that could lead to unauthenticated remote code execution.
An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/auth_service.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject claim.
Streambert before 2.5.0 improperly validates executable paths supplied to the run-download IPC handler, allowing a compromised renderer to execute arbitrary local binaries with the app's privileges.
Streambert before 2.5.0 has an unvalidated auto-updater URL vulnerability that allows a compromised renderer to make the main process download and execute an arbitrary binary, resulting in remote code execution.
YesWiki before 4.6.4 has an unauthenticated SQL injection in the Bazar form-import path, allowing any visitor to inject arbitrary SQL into an INSERT statement and read the full database, including password hashes.
AVideo has an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint, allowing remote attackers to write up to 4 GB of arbitrary content via HTTP PUT without authentication.
Vulnerability in SIMATIC IoT2050 Advanced devices with Node-RED installed. The Node-RED HTTP interface does not enforce authentication, allowing an unauthenticated attacker to create malicious flows and execute code with maximum privileges.
An authenticated attacker can spoof another GUI user's identity by sending a request with the custom header "Grpc-Metadata-USER". This can lead to an account takeover from a low-privileged user to administrator.
An OS command injection vulnerability in wg-easy 15.3.0 allows users with clients.create permission to execute arbitrary commands as root by injecting newline-delimited WireGuard PostUp directives into the client name field. The client name is written to the configuration file without neutralizing newline characters.
An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concatenated without escaping into a SQL WHERE clause.