CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Due to improper neutralization of special elements, an unauthenticated remote attacker can inject a command into the system configuration, which is then executed as root.
Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely. This creates a temporary window where internal services may become externally accessible, allowing an unauthenticated remote attacker to connect and fully compromise the system.
The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install modified firmware, leading to full system compromise.
The CHARX OCPP Agent service lacks authentication, allowing an unauthenticated remote attacker to reconfigure the backend connection. This can lead to Denial-of-Service and disclosure of confidential data.
The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of charging point UIDs, Denial-of-Service, and file tampering.
An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate input fetched from MQTT. This may lead to integrity and availability loss.
An unauthenticated remote attacker can post a malicious ID to the MQTT Broker, resulting in the creation of a new configuration entry in the system configuration. This may lead to integrity and availability loss.
Missing authentication in the MQTT broker allows an unauthenticated remote attacker to access the broker, which is only protected from external access by a firewall. This may lead to full compromise of the device.
In Rocket.Chat before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14, SAML SSO verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside any valid signature made by the trusted IdP certificate, and log in as an arbitrary user.
Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel.
The Remote API WordPress plugin through 0.2 does not authenticate requests before deserializing user-supplied input. Unauthenticated attackers can inject arbitrary PHP objects, potentially leading to remote code execution if a suitable gadget chain is present.
The Admin and Site Enhancements (ASE) Pro plugin for WordPress is vulnerable to Remote Code Execution in versions up to 8.9.0. The vulnerability is due to missing authentication in the frontend save handler, bypassable CAPTCHA, and unsanitized row keys from cfgroup[input] used in eval().
Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation does not require user interaction, and scope is changed.
In Google Chrome on Mac prior to version 151.0.7922.72, an inappropriate implementation in the Tint component allows a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
Insufficient validation of untrusted input in Google Lens in Google Chrome prior to version 151.0.7922.72 allows a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Insufficient validation of untrusted input in the AI component in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Insufficient validation of untrusted input in WebAuthn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file.
Insufficient validation of untrusted input in Notifications in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file.
Use after free in WebSockets in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
Insufficient validation of untrusted input in Picture-in-Picture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.