CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In Perl up to version 5.43.10, an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack. A large repeat count wraps the total negative, bypassing length checks and allowing reading past the buffer.
In Apache Airflow FAB auth manager, a DAG named `DAGs` collides with the global all-DAGs permission resource name. A user granted per-DAG access to that specific DAG silently receives global all-DAGs permissions, leading to privilege escalation.
The Apache Airflow Git provider defaults to StrictHostKeyChecking=no for git-over-SSH operations, disabling SSH host-key verification. An attacker can intercept the network path between an Airflow worker and the Git server (man-in-the-middle), impersonate the server, capture the SSH deploy key, or inject malicious repository content.
A buffer overflow vulnerability has been found in the "extension/readdir.c" file of gawk in the ftype() routine. This issue could crash the program and potentially allow code execution, although the latter has not been confirmed. It affects gawk versions 5.4.0 and below.
A Use After Free vulnerability has been found in the io.c file of gawk in the do_getline_redir() routine. It affects gawk versions 5.4.0 and below and may lead to a crash.
A privilege escalation vulnerability in the incluster-checks tool for OpenShift allows any user with the standard edit role to exec into privileged debug pods with host filesystem access and obtain root access on cluster nodes.
The WordPress plugin "ووسلام – همگام سازی ووکامرس و باسلام" (sync-basalam) version up to 1.9.1 is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can trick an administrator into performing unintended actions within their session context.
The WordPress plugin 'گرویتی فرم فارسی' (persian-gravity-forms) contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. The issue affects versions up to and including 3.0.2.
The Real Testimonials WordPress plugin (versions up to 3.1.15) has a deserialization of untrusted data vulnerability allowing object injection. An attacker can remotely exploit this flaw to execute arbitrary code.
The ICS Calendar WordPress plugin up to version 12.1.1 contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject malicious JavaScript via a crafted HTTP request.
The Funnel Builder plugin for WordPress contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject malicious JavaScript code into HTTP request parameters, which will be executed in the victim's browser.
The Forminator plugin for WordPress contains a path traversal vulnerability that allows an attacker to access files outside the restricted directory. The issue affects versions up to and including 1.55.0.2.
The Forminator plugin for WordPress contains a DOM-based XSS vulnerability due to improper input neutralization during web page generation. The issue affects versions up to and including 1.55.0.1.
The APIExperts Square for WooCommerce plugin (woosquare) version up to 4.7.4 is vulnerable to blind SQL injection. Improper neutralization of special elements in SQL commands allows an attacker to execute unauthorized database operations.
The Tonda WordPress plugin contains a PHP Local File Inclusion (LFI) vulnerability due to improper control of filename in include/require statements. The issue affects versions up to and including 2.5.
The TheGem Theme Elements (for Elementor) plugin by CodexThemes contains a PHP Local File Inclusion vulnerability due to improper control of filename for include/require statement. The issue affects versions before 5.12.1.1.
A vulnerability in Struktur Core from Select-Themes allows PHP Local File Inclusion due to improper control of filename in include/require statement. Affects versions before 2.7.
A vulnerability in the Struktur theme by Select-Themes allows PHP Local File Inclusion due to improper control of filename for include/require statement. This affects versions before 2.7.
The SetSail WordPress plugin is vulnerable to PHP Local File Inclusion (LFI) due to improper control of filename in include/require statements. This affects versions up to and including 2.1.
The Overworld WordPress plugin contains a Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. This affects versions up to and including 1.5.