CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.19)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL Injection vulnerability in Maps Marker Pro plugin versions up to and including 4.32. An unauthenticated attacker can inject SQL queries, potentially leading to unauthorized database access.
Critical vulnerability (CVSS 9.8) in Joomla extension Balbooa Forms versions prior to 2.4.3.2. Allows an unauthenticated attacker to inject and execute arbitrary PHP code on the server via a URL parameter in a shortcode, when the form has a custom PHP handler configured.
Unauthenticated remote code execution (RCE) vulnerability in JetEngine plugin versions up to and including 3.8.14. An attacker can execute arbitrary code on the server without logging in.
Vulnerability in NetScaler ADC and NetScaler Gateway products. Affects ADC versions from 14.1 through 73.32 and from 13.1 through 63.21; Gateway versions from 14.1 through 73.32 and from 13.1 through 63.21.
The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic (non-block) editor is active.
The TrueBooker WordPress plugin before 1.2.7 lacks proper authorization checks in some AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow.
The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path used to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target name. On Apache, the same flaw overwrites the site's .htaccess files, which breaks the site and can strip hardening rules that other security measures rely on.
The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator.
A flaw has been found in Comfast CF-N1-S 2.6.0.1, affecting the function get_para_from_uri in /cgi-bin/mbox-config. Manipulation of width/height arguments causes stack-based buffer overflow. The attack can be initiated remotely.
A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535, affecting the strcpy function in /goform/aspApBasicConfigUrcp. Manipulation of pvid leads to stack-based buffer overflow. Remote attack is possible and exploit is public.
A weakness has been identified in UTT HiPER 1200GW up to 2.5.3-170306, affecting the strcpy function in /goform/formGroupConfig. Manipulation of timestart leads to stack-based buffer overflow. Remote attack is possible and exploit is public.
A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections.
A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01, affecting the strcpy function in /cgi-bin/wan.cgi. Manipulation of wan_l2tp_password leads to stack-based buffer overflow. Remote attack is possible and exploit is public.
A Critical Stored XSS, Privilege Escalation, and Security Misconfiguration vulnerability in Confluence Data Center and Server allows an unauthenticated attacker to execute arbitrary HTML or JavaScript in a victim's browser, perform actions as a higher-privileged user, and exploit security best-practice oversights.
Buffer overflow in Dawn in Google Chrome on Android prior to 151.0.7922.169. A remote attacker can exploit a crafted HTML page to execute arbitrary code outside the sandbox.
Inappropriate implementation in Media in Google Chrome on Mac prior to 151.0.7922.169. A remote attacker can exploit a crafted HTML page to execute arbitrary code outside the sandbox.
A vulnerability in Oracle Fusion Middleware's Helidon product (Imperative Web Server component) version 4.5.3 allows an unauthenticated attacker to compromise Helidon via HTTP, leading to unauthorized data modification, partial data access, and partial denial of service. Scope change may impact additional products.
A vulnerability in Oracle Fusion Middleware's Helidon product (Imperative Web Server component) version 1.4.19 allows an unauthenticated attacker to compromise Helidon via HTTP, resulting in unauthorized data modification and full access to all Helidon data.
A vulnerability in Oracle Fusion Middleware's Helidon product (Imperative Web Server component) version 1.4.19 allows an unauthenticated attacker to compromise Helidon via HTTP, resulting in unauthorized data modification and full access to all Helidon data.
A vulnerability in Oracle Fusion Middleware's Helidon product (Imperative Web Server component) version 1.4.20 allows an unauthenticated attacker to compromise Helidon via HTTP, resulting in a complete takeover of Helidon.