CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.19)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated SQL Injection vulnerability in Affiliates Manager plugin versions up to 2.9.53. An attacker without authentication can inject SQL queries.
An unauthenticated attacker can remotely execute arbitrary code (RCE) in WP Compress versions prior to 7.20.01.
An unauthenticated attacker can perform PHP Object Injection in RegistrationMagic versions up to 6.0.9.7.
An unauthenticated attacker can exploit SQL Injection in Modern Events Calendar versions prior to 7.35.0.
An unauthenticated attacker can exploit SQL Injection in Sticky Chat Widget versions up to 1.4.2.
A user with the Contributor role can upload arbitrary files in GP Premium versions up to 2.5.5.
Seroval prior to 1.5.3 allows attacker-controlled JSON deserialization that can lead to unintended side effects, and when combined with frameworks registering callable wrappers, potentially unintended server-side invocation or remote code execution.
A user with the Contributor role can upload arbitrary files in Templatiq versions up to 0.2.5.
An unauthenticated attacker can perform PHP Object Injection in FundEngine versions up to 1.7.9.
A user with the Contributor role can upload arbitrary files in Sync Post With Other Site versions up to 1.9.3.
A user with the Contributor role can remotely execute code (RCE) in Cwicly versions up to 1.4.4.
The Piotnet Addons For Elementor Pro plugin versions up to 7.1.67 contains a vulnerability allowing unauthenticated arbitrary file upload.
Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154 and Thunderbird 154.
A stack-based buffer overflow vulnerability has been detected in the DHCP blobmsg Handler of the /sbin/netifd file in TRENDnet TEW-WLC100P version 12.07b01. The attack must be carried out from within the local network.
Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153 showed evidence of memory corruption or another security-relevant defect. We presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
Integer overflow in the Graphics component. Fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.