CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1.
SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1.
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType.
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id.
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1.
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the report.php and revenue_report.php via the fromDate parameter.
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1.
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1.
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_membership.php?id=1.
CodeAstro Membership Management System 1.0 is vulnerable to SQL injection in /print_membership_card.php via the id parameter. An attacker can exploit this flaw to execute unauthorized database queries.
Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL injection in /show_price_by_pdtId.php. An attacker can exploit this flaw to execute unauthorized database queries.
Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware.
Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default credentials.
Apache Tika from 4.0.0-alpha-1 to before 4.0.0-beta-1 has an improper protection of alternate path vulnerability. An attacker could exploit this to bypass security controls.
IBM Langflow OSS versions 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system due to improper control of user input code.
Action Pack (Active Storage) prior to versions 7.2.3.2, 8.0.5.1 and 8.1.3.1 does not disable unsafe libvips operations for untrusted content, allowing a crafted upload to read arbitrary files accessible to the Rails process.
In Activepieces before version 0.84.0, an unsanitized path segment in the Code piece sandbox lets an authenticated flow author read and write cached flow and code files belonging to other tenants on the same worker. This can expose embedded data and allow modified code to execute on a victim tenant's next flow run.
In @aws-amplify/codegen-ui-react before version 2.20.6, improper control of code generation might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema values. This is due to insufficient coverage and effectiveness of input validation introduced for CVE-2025-4318.
SGLang contains a remote code execution (RCE) vulnerability when loading model weights from a HuggingFace repository. In the /update_weights_from_disk endpoint, torch.load with weights_only=False allows pickle deserialization of .bin files.
SGLang contains a remote code execution (RCE) vulnerability in the optional dumper subsystem. When DUMPER_SERVER_PORT is set, a sandbox escape is possible, enabling code execution on inference requests.