CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Cal.com OSS lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords, by triggering webhook delivery.
Dell PowerProtect Data Manager versions prior to 20.2.0.0 contain an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could exploit this vulnerability, leading to privilege escalation.
Dell PowerProtect Data Manager versions prior to 20.2.0.0 contain an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could exploit this vulnerability, leading to privilege escalation.
A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for unauthenticated remote code execution (pre-auth RCE) on GNU/Linux or Oracle Solaris.
SQL injection vulnerability in Xpoda Türkiye Informatics Technology Inc. No Code Platform allows an attacker to manipulate database queries due to improper neutralization of special elements in an SQL command. The issue affects versions from 4.1.3 before 4.1.4.
Check Point Security Management and Multi-Domain Security Management contain an authentication bypass vulnerability. An unauthenticated remote attacker can execute administrative commands on the Management Server and on managed Security Gateways. Network access to the Management Server without firewall protection or a configuration that does not restrict Trusted Clients is required.
In Unbound library versions 1.4.22 through 1.25.1, a vulnerability allows DNS cache poisoning attacks. The issue arises from deterministic assignment of UDP port ranges to worker threads when SO_REUSEPORT is enabled, enabling an attacker to predict the source port and reduce DNS transaction entropy.
Authentication bypass vulnerability in Check Point SmartConsole login. An unauthenticated remote attacker can obtain a login token and authenticate with full administrative privileges. The vulnerability is being actively exploited.
Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based XSS attack. When deployed with a specific configuration, it runs in the same origin as the host application, allowing an attacker full access to its resources.
In n8n before 2.29.8 and 2.30.x before 2.30.1, the @n8n/computer-use package does not enforce shell sandbox restrictions on Linux and Windows (sandboxing was applied only on macOS). Shell commands executed by the tool run without any filesystem or network restrictions, allowing unrestricted access to the host filesystem and network from within the computer-use agent process. This issue only affects deployments where the @n8n/computer-use package is explicitly installed and running; standard n8n installations are not affected.
The Joomla extension Page Builder CK below version 3.6.2 has an improper access control vulnerability, allowing an authenticated attacker to upload arbitrary files, leading to remote code execution (RCE).
Netty versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final have a vulnerability in XmlDecoder where delivering XML with a DOCTYPE declaration to an AsyncXMLInputFactory without security configuration can activate DTD and entity handling, creating XML External Entity (XXE) risk.
Use-after-free vulnerability in the GPU component of Google Chrome on Android prior to 150.0.7871.182. A remote attacker who compromised the renderer process could potentially escape the sandbox via a crafted HTML page.
Out-of-bounds read and write vulnerability in ANGLE in Google Chrome on Android prior to 150.0.7871.182. A remote attacker could potentially escape the sandbox via a crafted HTML page.
In Google Chrome prior to 150.0.7871.182, an integer overflow in Chromecast allows a local attacker to potentially perform a sandbox escape via malicious network traffic.
Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on the charging station.
Autel Maxi Charger Single firmware up to version V1.03.51 is vulnerable to OS command injection via the /test endpoint on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary system commands.
Autel Maxi Charger Single firmware up to version V1.03.51 has an unauthenticated remote code execution vulnerability via the service listening on TCP port 9002. A crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled files with root privileges.
Vulnerability in Oracle HRMS (UK) (component: UK Payroll) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can compromise the system, leading to unauthorized creation, deletion, or modification of critical data and access to all Oracle HRMS (UK) data. Scope change impacts additional products.
Vulnerability in Oracle Applications Framework (Web Utilities component) versions 12.2.8-12.2.15. Easily exploitable, allows a high-privileged attacker via HTTP to take over the system, with impact on other products (scope change).