CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
phpMyFAQ before version 4.1.6 contains a remote code execution vulnerability in the configuration API. An authenticated administrator with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges can manipulate the upgrade.lastDownloadedPackage setting to write arbitrary PHP files and achieve code execution as the web server user.
SiYuan desktop before version 3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler. An attacker can craft a malicious siyuan:// deep link that, when clicked, executes arbitrary JavaScript with full Node.js access via insertAdjacentHTML in an insecurely configured Electron renderer.
VeloCloud Orchestrator (VCO) on-prem has a vulnerability that allows a remote attacker to access privileged internal functionality, impacting the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and managed data. This issue is actively exploited.
SQL injection vulnerability in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.5.1. Unsanitized user input passed to the CodeIgniter Query Builder's order_by method allows time-based queries and schema enumeration. Under certain MySQL configurations, it may lead to remote code execution via writing a PHP shell using INTO OUTFILE.
The AWP Classifieds plugin for WordPress version 4.4.7 and earlier contains an unauthenticated SQL injection vulnerability.
The rtMedia plugin for WordPress, BuddyPress, and bbPress version 4.7.10 and earlier contains an unauthenticated SQL injection vulnerability.
The GamiPress plugin for WordPress version 7.9.7 and earlier contains an unauthenticated SQL injection vulnerability.
The Relevanssi Light plugin version 1.2.2 and earlier contains an SQL injection vulnerability exploitable by an unauthenticated attacker.
The MapSVG plugin version 8.14.0 and earlier contains an SQL injection vulnerability exploitable by an unauthenticated attacker.
Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1. The hardcoded secret allowed attackers to forge the mail from address of forms.
Joomla extension SP Page Builder before version 6.8.0 contains an unauthenticated SQL injection vulnerability. Improper validation of catid parameters in the loadMoreArticles endpoint allows an attacker to execute SQL queries.
The SP Page Builder extension for Joomla versions below 6.7.1 contains an unauthenticated SQL injection vulnerability in the Dynamic Content endpoint due to improper validation of the order parameter.
vBulletin versions 5.x through 5.7.5 and 6.x through 6.2.1 contain an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method, allowing unauthenticated remote attackers to execute arbitrary PHP code via crafted pagenav[pagenumber] parameter.
Improper validation of specified quantity in input and out-of-bounds read in Apache Thrift C++ bindings. Affects versions before 0.24.0.
A vulnerability in Apache Thrift c_glib bindings before version 0.24.0 causes an out-of-bounds read, potentially leading to data disclosure or crash.
Apache Thrift versions before 0.24.0 contain a heap-based buffer overflow vulnerability in the C++ bindings, potentially leading to crashes or remote code execution.
Apache Thrift versions before 0.24.0 contain a certificate validation vulnerability with host mismatch in the c_glib bindings, potentially enabling man-in-the-middle attacks.
In the NVMe/TCP subsystem of the Linux kernel, when a data digest mismatch occurs on a non-final H2C_DATA PDU, nvmet_tcp_try_recv_ddgst() calls nvmet_req_uninit() without marking the command as completed. This leads to a double call to nvmet_req_uninit() during queue teardown, resulting in a double free and potential use-after-free (UAF).
In the NVMe/TCP subsystem of the Linux kernel, in nvmet_tcp_try_recv_ddgst(), the call to nvmet_req_uninit() is unconditional. If the command arrived via the nvmet_tcp_handle_req_failure() path, the percpu_ref was never taken, leading to a refcount underflow and potential use-after-free.
The FacturaONE para WooCommerce con VeriFactu WordPress plugin before version 5.37 does not authenticate one of its request handlers. Its only protection is a cryptographic key that is empty in the default, unconfigured state. Unauthenticated attackers can write an arbitrary file into a web-accessible directory and achieve remote code execution.