CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmd_receive and cmd_send fields on the Partner model. These fields are passed directly to os.system() in pyas2/utils.py without sanitization, allowing an authenticated admin user to execute arbitrary commands on the server when an AS2 message is received or sent.
Feng Office 3.11.13.11 has an unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php. Remote attackers can upload malicious files (e.g., .html) to the web-accessible /tmp/ directory.
IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 do not properly neutralize input during web page generation, allowing remote attackers to execute arbitrary scripts (XSS).
An output mismatch between the RTL and the netlist of the or1200 cpu output port in openRISC OR1200 (commit 83ac6b) can lead to unexpected behavior.
IBM Langflow OSS versions 1.0.0 through 1.10.0 (up to commit 94981c443d4918517b9e8163d70fc598dc33a32d) contain a code injection vulnerability in the Policies component's ToolGuard integration that bypasses the allow_custom_components=false security control, allowing authenticated users with flow creation privileges to execute arbitrary Python code on the server.
Vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0. The /api/v1/login/auto_login endpoint issues long-lived superuser bearer tokens without authentication when AUTO_LOGIN is enabled (default). Permissive CORS settings may expose tokens to untrusted origins.
IBM Langflow OSS versions 1.0.0 through 1.10.0 allow unauthenticated attackers to create unlimited user accounts. When NEW_USER_IS_ACTIVE=true is set, new accounts are immediately active and can access RCE endpoints.
IBM Langflow OSS versions 1.0.0 through 1.10.0 allow unauthenticated attackers to chain the /api/v1/auto_login endpoint (generates SUPERUSER tokens) with /api/v1/validate/code (executes code via exec()), leading to remote code execution (RCE) on default installations.
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.
An SQL injection vulnerability has been discovered in GisLab Laboratory Management System due to improper neutralization of special elements in SQL commands. The flaw affects versions from 1.4.03 through 08072026.
In the halo2_gadgets library up to 0.5.0 and related Zcash components (zebrad, orchard, zcash_primitives, zcashd), there is a vulnerability due to missing a copy constraint for the base point in the variable-base scalar multiplication gadget. This allows a malicious prover to generate a valid proof for an Orchard Action with an under-constrained base point, bypassing the diversified-address-integrity check.
A missing authorization vulnerability in Vimesoft Inc. Enterprise Video Platform allows accessing functionality not properly constrained by ACLs. This issue affects versions from 3.11.0.0 before 3.25.0.
An authorization bypass vulnerability in Vimesoft Inc. Enterprise Video Platform allows accessing functionality not properly constrained by ACLs through a user-controlled key. The issue affects versions from 3.11.0.0 before 3.25.0.
An unverified password change vulnerability in Vimesoft Enterprise Video Platform allows authentication bypass. Affects versions from 3.11.0.0 before 3.25.0.
The Joomla extension Events Booking prior to version 5.8.0 by default allows unauthenticated users to upload media assets. This is an insecure default configuration.
An XML External Entity (XXE) vulnerability was discovered in libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7. It allows an attacker to load external XML entities, potentially leading to file disclosure or unauthorized requests.
A business logic vulnerability in HCL Aftermarket EPC allows an unauthorized user to obtain passwords from the server by manipulating server responses. Lack of validation on email requests enables redirecting passwords to the attacker's own email address.
The AI Copilot WordPress plugin before version 1.5.4 does not bind OAuth access tokens to a WordPress user and accepts any valid token as an administrator session. This allows unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitrary user creation and role escalation.
The Aimogen Pro WordPress plugin contains a privilege escalation vulnerability. Missing capability checks in the 'aiomatic_call_google_ai_function' function allow unauthenticated attackers to use the 'aimogen_wp_god_mode' tool to clear function blacklists and execute arbitrary PHP functions, including creating administrator accounts.
The clawvet self-hosted API server before version 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as default in .env.example. Additionally, GET /api/v1/scans returns scan records containing userId values without authentication, allowing a remote unauthenticated attacker to harvest a victim's userId, forge a valid HS256 cg_session cookie offline using the known secret, and call GET /api/v1/auth/me to obtain the victim's email address, subscription plan, and secret apiKey.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS