CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.19)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.
Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. It affects both mobile user VPN with IKEv2 and branch office VPN using IKEv2 when configured with a dynamic gateway peer. Even after deleting those configurations, if a branch office VPN to a static gateway peer remains, the Firebox may still be vulnerable.
A vulnerability in Fortinet FortiOS, FortiProxy, and FortiSwitchManager related to improper verification of cryptographic signature allows an unauthenticated attacker to bypass FortiCloud SSO login authentication via a crafted SAML response message.
A vulnerability in Langflow versions up to and including 1.6.9 enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie set as SameSite=None allows a malicious webpage to perform cross-origin requests with credentials and call the refresh endpoint. An attacker can obtain fresh access_token/refresh_token pairs for a victim session and use them to execute arbitrary code, leading to full system compromise.
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, including packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
Ray is an AI compute engine. Prior to version 2.52.0, developers using Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This is due to insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with 'Mozilla'. This defense is insufficient because the fetch specification allows modifying the User-Agent header. Combined with DNS rebinding, the vulnerability is exploitable against a developer who inadvertently visits a malicious website or sees a malicious ad. Patched in version 2.52.0.
A type confusion vulnerability in the V8 engine of Google Chrome prior to version 142.0.7444.175 allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. The issue is rated as High severity by the Chromium security team.
The Endpoint Manager module in FreePBX, in versions 17.0.2.36 and above before 17.0.3, is vulnerable to post-authentication command injection by an authenticated known user. An attacker can leverage this vulnerability to gain remote access to the system as an asterisk user.
Vulnerability in Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI) affects versions 12.2.3-12.2.14. It is easily exploitable by an unauthenticated attacker with network access via HTTP, potentially resulting in unauthorized access to critical data or complete access to all Oracle Configurator data. CVSS 3.1 Base Score is 7.5 (Confidentiality impact).
Vulnerability in Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration) affects versions 12.2.3-12.2.14. It is easily exploitable by an unauthenticated attacker with network access via HTTP, potentially leading to full takeover of Oracle Concurrent Processing. CVSS score 9.8.
A vulnerability in the VPN web server of Cisco Secure Firewall ASA and FTD Software allows an unauthenticated, remote attacker to access restricted URL endpoints related to remote access VPN that should be inaccessible without authentication. The issue is due to improper validation of user-supplied input in HTTP(S) requests. A successful exploit could allow access to a restricted URL without authentication.
A vulnerability in the VPN web server of Cisco Secure Firewall ASA and FTD Software allows an authenticated, remote attacker to execute arbitrary code on the device. The issue is due to improper validation of user-supplied input in HTTP(S) requests. A successful exploit could allow the attacker to execute code as root, potentially leading to full device compromise.
A type confusion vulnerability in the V8 engine in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. The issue is rated as high severity.
A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
Out-of-bounds write vulnerability in the iked process of WatchGuard Fireware OS. A remote unauthenticated attacker can execute arbitrary code. Affects mobile user VPN with IKEv2 and branch office VPN using IKEv2 when configured with a dynamic gateway peer. If configurations were deleted but a branch office VPN to a static peer remains, the device may still be vulnerable.
FreePBX, an open-source graphical user interface, has vulnerabilities in versions 15, 16, and 17 due to insufficiently sanitized user-supplied data. This allows unauthenticated access to the FreePBX Administrator, leading to arbitrary database manipulation and remote code execution.
WinRAR for Windows has a path traversal vulnerability that allows attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild.
A vulnerability in WebKit allows memory corruption when processing maliciously crafted web content. The issue was fixed by improving memory handling in Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.
A race condition was found in the Linux kernel between handle_posix_cpu_timers() and posix_cpu_timer_del(). An exiting non-autoreaping task can be reaped by its parent after unlock_task_sighand(), causing synchronization issues.