CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The GeoIP extension for Joomla! extracts database update archives without path validation, leading to a Zipslip vulnerability.
The Cache Cleaner Pro extension for Joomla! exposes CDN credentials in administrator request URLs.
The Cache Cleaner Pro extension for Joomla! (from regularlabs.com) is vulnerable to Server-Side Request Forgery (SSRF). Custom query URLs can access internal or reserved network services.
The MountDev AI MCP Connector plugin for WordPress versions up to 1.6.1 has an authorization bypass vulnerability. An unauthenticated attacker can obtain an administrator-bound OAuth Bearer token by exploiting publicly accessible client registration and authorization endpoints.
The Customer Support Ticket System & Helpdesk plugin for WordPress up to version 6.0.5 is vulnerable to code injection via the 'path' parameter due to dynamic function invocation on an attacker-controlled value with insufficient validation. Unauthenticated attackers can invoke arbitrary parameterless PHP functions, disrupting site functionality or exposing sensitive information. The required nonce is publicly emitted via wp_localize_script when the [emd_form] shortcode is rendered on any public-facing page.
The GoDAM plugin for WordPress up to version 1.12.2 allows unauthenticated attackers to upload arbitrary files to the server, potentially leading to remote code execution due to insufficient file type validation in the save_video_file() function.
A remote code execution (RCE) vulnerability in fastjson versions 1.2.68 through 1.2.83. The vulnerability is exploitable under default configuration, without requiring AutoType enablement or classpath gadgets.
Vulnerability in Oracle Platform Security for Java (Oracle Fusion Middleware) in the Centralized Thirdparty Jars component. Affects versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable by an unauthenticated attacker with network access via HTTP, potentially leading to takeover of Oracle Platform Security for Java. CVSS 9.8.
Vulnerability in Oracle Platform Security for Java (Centralized Thirdparty Jars component) versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable, allows a low-privileged attacker via HTTP to take over the system, with impact on other products (scope change).
Vulnerability in Oracle Platform Security for Java (component: Centralized Thirdparty Jars) allows unauthenticated attacker via HTTP to compromise the system. CVSS 9.8.
Vulnerability in Oracle Platform Security for Java (component: Centralized Thirdparty Jars) allows unauthenticated attacker via HTTP to compromise the system. CVSS 10.0.
The IP Login extension for Joomla! by regularlabs.com generates persistent URL login keys using a non-cryptographic random generator with insufficient entropy, making them predictable.
The Sourcerer extension for Joomla! by regularlabs.com has multiple code injection vectors: Free version does not require both article creator and last modifier to be Super Users before executing PHP; Pro inconsistently enforces CSS, JavaScript, and PHP permissions; PHP include attributes can escape the configured folder; executable script/style variants can bypass detection.
The Articles Anywhere and Modules Anywhere extensions for Joomla allow content tags to use ignore flags or property overrides to render restricted or unpublished articles or modules. A content author can expose content to visitors lacking required access.
An issue in ConeXware, Inc Power Archiver v.22.00.11 and before allows a remote attacker to escalate privileges and execute arbitrary code via the powerarc.exe.
Cal.com OSS lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords, by triggering webhook delivery.
Dell PowerProtect Data Manager versions prior to 20.2.0.0 contain an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could exploit this vulnerability, leading to privilege escalation.
Dell PowerProtect Data Manager versions prior to 20.2.0.0 contain an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could exploit this vulnerability, leading to privilege escalation.
A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for unauthenticated remote code execution (pre-auth RCE) on GNU/Linux or Oracle Solaris.
SQL injection vulnerability in Xpoda Türkiye Informatics Technology Inc. No Code Platform allows an attacker to manipulate database queries due to improper neutralization of special elements in an SQL command. The issue affects versions from 4.1.3 before 4.1.4.