CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.05)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Media Library Helper plugin versions <= 1.2.0 has a Cross-Site Request Forgery (CSRF) vulnerability. This allows attackers to send unauthorized requests on behalf of users.
The Royal Elementor Addons plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to and including 1.3.70. The API key is added to the source code of any page running the MailChimp block, allowing unauthenticated attackers to obtain the MailChimp API key.
Several WordPress themes by DeoThemes are vulnerable to reflected Cross-Site Scripting (XSS) via breadcrumbs in various versions due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts on pages.
The ProfileGrid plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the 'pm_upload_csv' function in versions up to and including 5.5.1. This allows authenticated attackers with subscriber-level permissions or higher to import new users and update existing users.
CVE-2023-34143 describes an improper validation of certificate with host mismatch vulnerability in Hitachi Device Manager on Windows and Linux. This allows for a Man in the Middle attack, potentially leading to data interception.
Open Enclave SDK version 0.19.3 addresses two vulnerabilities. The first concerns improper sanitization of the `MXCSR` register on enclave entry, which can lead to MCDT attacks. The second involves the lack of sanitization of the `RFLAGS.AC` flag, allowing attackers to monitor unaligned memory accesses.
An issue was discovered in set_con2fb_map in the Linux kernel before version 6.2.12. The problem is that an assignment occurs only for the first vc, which can lead to desynchronization of the fbcon_registered_fb and fbcon_display arrays.
OpenRefine is a free, open source tool for data processing that contains a vulnerability allowing arbitrary code execution in the context of the OpenRefine process. A malicious OpenRefine project tar file can be exploited if a user is convinced to import it.
An issue in the emqx_sn plugin of EMQX v4.3.8 allows attackers to execute a directory traversal via uploading a crafted .txt file.
The discovered faust commit ee39a19 contains a stack overflow in the component boxppShared::print() at /boxes/ppbox.cpp.
A FPE vulnerability was discovered in master commit e4c878 via the component combine_inner at /pixman-combine-float.c.
Metersphere is an open-source testing framework that allows file uploads with a `belongType` value containing a relative path, which may lead to overwriting an existing file or creating a new one. Attackers can only overwrite files that the Metersphere process has access to.
Firmware versions of Zyxel ATP, USG FLEX, USG20(W)-VPN, VPN, NXC2500, and NXC5500 contain a buffer overflow vulnerability that could allow an unauthenticated, LAN-based attacker to cause denial of service (DoS) conditions by sending a crafted request to the CAPWAP daemon.
Mattermost fails to properly validate a gif image file, allowing an attacker to consume a significant amount of server resources, making the server unresponsive for an extended period of time.
Mattermost fails to properly validate markdown, allowing an attacker to crash the server via a specially crafted markdown input.
Mattermost fails to invalidate previously generated password reset tokens when a new reset token is created.
Mattermost fails to disable public Boards after the 'Enable Publicly-Shared Boards' configuration option is disabled, resulting in previously-shared public Boards to remain accessible.
Mattermost Boards fail to properly validate a board link, allowing an attacker to crash a channel by posting a specially crafted boards link.
Mattermost fails to verify channel membership when linking a board to a channel, allowing a low-privileged authenticated user to link a Board to a private channel they don't have access to.
Mattermost fails to properly validate the origin of a websocket connection, allowing a MITM attacker to access the websocket APIs.