CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An SSRF vulnerability in AVideo (before version 8.1.0) allows an unauthenticated remote attacker to read responses from internal HTTP/HTTPS and FTP services. The `url_get_contents` function does not reject private, loopback, or link-local addresses and disables TLS peer verification, while the `objects/login.json.php` endpoint returns the fetched body. Additionally, `view/youtubeDl.json.php` enables requests to internal FTP servers.
In AVideo before 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. The endpoints `view/run.php`, `view/queue.json.php`, `view/status.php`, and `view/listFiles.json.php` allow an unauthenticated attacker to drive the privileged queue processor, read queue and streamer-site information, obtain memory statistics, and enumerate media file names and paths in any directory readable by the web-server user. This is fixed in version 8.1.0.
In AVideo before 8.1.0, the unauthenticated streamer login at `objects/login.json.php` passes the `user` parameter to `Streamer::get`, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although `objects/security.php` strips literal single quotes, `html_entity_decode` in `objects/Login.php` restores entity-encoded quotes before the query. UNION results are exposed through `streamers_id`, while failures return the rendered query and MariaDB error. This is fixed in version 8.1.0.
In AVideo before 8.1.0, the live-streaming endpoint `view/videosListToLive.php` trusts attacker-supplied data in `webSiteRootURL` as session state, allowing an unauthenticated attacker to self-grant `isLogged` and `canStream`. Video-list paths are interpolated without escaping into `ffprobe` and `ffmpeg` commands executed via `exec`, enabling OS command injection. This is fixed in version 8.1.0.
In AVideo before 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating request parameters, including `webSiteRootURL`, into single-quoted PHP literals without escaping. An attacker can terminate a literal and inject PHP executed as the web-server user. Exploitation requires `videos/configuration.php` to be absent, and database parameters can point to an attacker-controlled server. This is fixed in version 8.1.0.
AnkiMCP prior to version 0.21.0 globally disables FastMCP DNS-rebinding protection, including for the default local Streamable HTTP listener on 127.0.0.1:3141, with no bearer token, API key, or strict Host/Origin allowlist. A victim visiting a malicious web page while Anki and the listener are running can have browser requests rebound to loopback, allowing the attacker to initialize MCP, enumerate tools, read the local collection, and perform enabled non-destructive note/deck creation or updates.
Prior to 1.40.0, Blombooru's administrator-only GET /proxy-image endpoint, exposed as /api/booru-import/proxy-image, accepts a url query parameter and fetches it server-side without meaningful destination validation. proxy_image() only checks whether the value starts with http, then uses get_client_for_url or requests.get and streams the response; private, loopback, and link-local addresses are not blocked, and automatically followed redirects can move a request from a trusted domain to an internal address.
OpenCATS before version 0.10.0 contains a SQL injection vulnerability in activity DataGrid date filtering in `home:CallsDataGrid` and `activity:ActivityDataGrid`, where the `period`, `startDate`, and `endDate` parameters are used without sufficient validation or escaping. An authenticated user with access to the affected DataGrid endpoints can alter the intended query to access sensitive database contents, including user account data, candidate records, contact details, company information, job orders, and activity history. A valid OpenCATS login is required. This is fixed in version 0.10.0.
In OpenCATS prior to version 0.10.0, the Professional License configuration feature in SettingsUI accepts administrator-controlled license key input that is reconstructed into a PHP define() statement in config.php without safe escaping. Because the application includes config.php, crafted input can alter the file's PHP syntax and cause persistent arbitrary PHP execution with the web server process privileges.
Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post_status and post_type values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/query_result REST endpoint using a publicly obtainable nonce. Attackers can set post_status to draft or private, or post_type to shop_coupon, to disclose unpublished posts, private content, and WooCommerce coupon data.
Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to control the urlParams object in the query_result REST endpoint, causing the submitted value to be re-parsed as a Bricks dynamic data tag. Attackers can inject tags such as author_meta:user_pass, author_meta:user_email, or cf_coupon_amount to leak post meta and the post author's user record, including the password hash.
PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the update_fees AJAX handler that allows unauthenticated attackers to modify and read other customers' orders. Attackers can reuse a nonce from their own order-pay page and supply sequential order_id values to change payment methods, recalculate fees, and disclose order line items and totals.
gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries, causing a victim's recursive gopass rm -r to delete arbitrary directory trees.
Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell metacharacters such as $(...) and then move or copy it, running commands as the web server user.
Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via the ref parameter to read titles, descriptions, salary budgets, and recruiter names and emails.
FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.25 contain a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GIF frame rectangles. Attackers can craft a GIF whose frame left plus width exceeds the logical screen width, causing GifPlaybackCompositeFrame() and GifPlaybackFillRect() to corrupt heap memory when loaded with GIF_PLAYBACK.
FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.22 contain a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attackers can supply a crafted IFF/LBM PBM file with runs straddling scanline ends to write up to 127 controlled bytes past the heap-allocated bitmap.
python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations. Attackers can submit repeated '[a](' or ', backticks, or semicolons unquoted to std::system, running commands as the victim on click.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS