CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all installations. This makes it possible for unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.
The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the login code, and redeem it through an unauthenticated AJAX action to log in as that user, including an administrator, without a password.
The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions (force-logout) of any user on the site, including administrators.
The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise.
A vulnerability in the Linux kernel involves the TC_ACT_CONSUMED case in the tcf_qevent_handle function in net/sched/cls_api.c. When tcf_classify() returns TC_ACT_CONSUMED, the skb is held by the defragmentation engine and must not be touched further. Missing handling leads to a use-after-free (UAF) in red_enqueue().
OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier.
SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, gated only by a general auth check with no admin-role or read-only enforcement, exposing 31 MCP tools including file operations across the entire workspace.
In the Linux kernel net/handshake mechanism, a long-lived file reference was missing during handshake request processing. Using sock_hold() did not protect the socket structure from being destroyed by the consumer, potentially leading to use-after-free.
In the Linux kernel, the tcp_ao_destroy_sock function removed the call_rcu() call, breaking RCU synchronization. During connection setup (TCP_SYN_SENT), the socket is visible to other CPUs, which may read the ao_info pointer just before it is freed, leading to a use-after-free vulnerability.
In the Linux kernel, a vulnerability in the TIPC broadcast mechanism allows an out-of-bounds read. The tipc_get_gap_ack_blks() function fails to verify that the Gap ACK block record fits within the message data area, enabling an attacker to trigger a kmemdup() read beyond the allocated skb buffer.
In the Linux kernel's crypto: krb5 module, a use-after-free occurs when using async AEAD implementations. Cryptographic functions set a NULL callback and treat any negative return as an error, freeing the buffer. When the implementation is async, it returns -EINPROGRESS and the buffer is freed while the backend still uses it.
In the Linux kernel netfilter flowtable subsystem, hardware offload for IPIP tunnels is not yet supported. Despite this, offload attempts are queued to a worker and then ignored, causing unnecessary overhead. The patch adds early checking and bail-out for IPIP tunnel offload.
In the Linux kernel ksmbd SMB server, the FSCTL_DUPLICATE_EXTENTS_TO_FILE function lacks write permission checks at the share and handle levels, allowing a client to overwrite destination file data even on a read-only share or with a FILE_WRITE_ATTRIBUTES handle.
In the Linux kernel, the ksmbd filesystem has a concurrency issue with directory queries. Concurrent QUERY_DIRECTORY requests for the same file handle can overwrite a stack pointer, leading to a use-after-free.
In the Linux kernel, the ksmbd filesystem runs SET_INFO operations with the current ksmbd worker credentials instead of the credentials of the user who opened the handle. This can bypass owner-based and LSM access controls.
In the Linux kernel, the ksmbd filesystem runs the delete-on-close operation with the ksmbd worker credentials instead of the credentials of the user who opened the handle. This can bypass filesystem permission checks.
In the Linux kernel, the ksmbd filesystem runs alternate data stream (ADS) I/O operations with the current task credentials instead of the credentials of the user who opened the SMB handle. This can bypass inode permission and LSM checks.
In the Linux kernel, SMB client has a double-free vulnerability in query directory replay. A response-bearing attempt can free its buffer, and if SMB2_query_directory_init() fails before the next send, cleanup frees the same buffer again. The fix resets response bookkeeping before each attempt.
In the Linux kernel, SMB client has a double-free vulnerability in query_info() replay. A response-bearing attempt can free its buffer, and if SMB2_query_info_init() fails before the next send, cleanup frees the same buffer again. The fix resets response bookkeeping before each attempt.
In the Linux kernel, SMB client has a double-free vulnerability in SMB2_ioctl() replay. A response-bearing attempt can free its buffer, and if SMB2_ioctl_init() fails before the next send, cleanup frees the same buffer again. The fix resets response bookkeeping before each attempt.