CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation. Requires domain administrator access. Impact is lower in Windows deployments.
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation to a system administrator with the ability to execute commands as the root user. This issue requires a domain account with administrator access. The impact is lower in Windows deployments.
Vulnerability in SolarWinds Serv-U involving insecure direct object reference (IDOR) allows account takeover. Authentication is required, impact is lower on Windows deployments.
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover. Impact is lower in Windows deployments.
Privilege escalation vulnerability in SolarWinds Serv-U. An attacker can elevate group privileges to system administrator and execute code as root. Impact is lower on Windows.
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to escalate their user type to that of a system administrator. Impact is lower in Windows deployments.
SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. Impact is lower in Windows deployments.
SolarWinds Serv-U is affected by an IDOR vulnerability that can lead to remote code execution. Domain administrator access is required. Impact is lower on Windows deployments.
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group. Impact is lower in Windows deployments.
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator. Impact is lower in Windows deployments.
SolarWinds Serv-U is affected by an IDOR vulnerability that can lead to remote code execution as root. A domain account with admin privileges and read/write access to the home directory is required. Impact is lower on Windows deployments.
SolarWinds Serv-U is affected by a remote code execution vulnerability that allows arbitrary code execution as root. Impact is lower on Windows deployments.
SolarWinds Serv-U is affected by an IDOR vulnerability that can lead to privilege escalation and remote code execution as root. Group administrator access is required. Impact is lower on Windows deployments.
The Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data. Attackers can send a crafted POST request to the admin-ajax.php endpoint with the nf_delete_all_data action and a per-site nonce to invoke migration routines that unconditionally iterate all blogs via switch_to_blog(), dropping all nf3_* tables and clearing options and transients across every subsite in the network without requiring super-admin or network-admin privileges.
The Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature. The parseSubmissionIndex() function accepts arbitrary strings as submission indexes without numeric validation, and admin_form_element() interpolates the index directly into HTML without escaping. An unauthenticated attacker can submit a public form with a crafted repeater child key containing malicious script payloads, which execute in an administrator's browser when viewing submissions in the WordPress admin panel.
In Microsoft Azure API Management, when self-service signup (Basic Authentication) is enabled, an attacker can reuse the registration flow for another tenant by changing the Host header, even if signup is disabled in the UI. The vendor considers this a configuration issue, not a vulnerability.
Memory safety bugs in Firefox ESR 140.12 and Firefox 152 could lead to memory corruption and potentially remote code execution. Patches are available in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Memory safety bugs in Firefox 152 that could allow arbitrary code execution. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
JIT miscompilation in the JavaScript Engine leads to incorrect code generation. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
Integer overflow in the Audio/Video: Playback component in Firefox and Thunderbird. Fixed in versions 153.