CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Model Context Protocol (MCP) before version 0.25.0 lacked Origin header validation to prevent DNS rebinding attacks. Version 0.25.0 introduces the --allowed-hosts flag, which defaults to '*' and warns about potential vulnerabilities.
State mutation vulnerability in OpenClaw before 2026.5.27 in node pairing reconnection logic. Attackers can exploit reconnection logic to restore or present broader node authority than intended, potentially bypassing approval restrictions.
ApostropheCMS is a Node.js content management system that, in versions up to 4.30.0, allows unauthorized modifications to object prototypes by authenticated editors. The use of the `$pullAll` operator enables writing arbitrary values to `Object.prototype`, leading to authorization bypass on all REST API endpoints.
Nezha Monitoring prior to version 2.0.13 has a vulnerability in the NoRoute handler in the dashboard that allows access to admin assets without authentication. By exploiting an incorrect URL prefix check, an attacker can access system files.
Nezha Monitoring versions from 1.4.0 to before 2.0.8 allow RoleMember users to create scheduled cron tasks that can execute arbitrary commands on servers, including those belonging to other users. This poses a risk of unauthorized access to systems.
A web page containing unusual WebGPU content can load it into the GPU GLES render process, leading to an out-of-bound write in the GPU user-space driver. This may result in memory corruption and possible browser/GPU process crash.
Vulnerability in sanitize-html library (versions prior to 2.17.4) in default configuration allows bypassing sanitization and injecting HTML/JavaScript via the <xmp> element. This can lead to stored XSS in applications rendering sanitized output.
Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image. Once this salt is recovered from any device, an attacker can generate valid signatures for arbitrary device or account operations, leading to request forgery and impersonation.
SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. Identity tokens submitted during login are accepted without verifying their cryptographic signature, allowing a remote, unauthenticated attacker to obtain a fully authenticated technician session.
SQL injection vulnerability in MariaDB (versions 3.3.18 and 3.4.8) despite using mysql_real_escape_string() with big5 charset. Fixed in versions 3.3.19 and 3.4.9.
A vulnerability in MariaDB on Windows with the CONNECT engine installed and REST support enabled allows interpolation of the table HTTP attribute into the curl command line without proper sanitization. This enables the user to execute shell commands on the server.
Aqara Home Android app (version 6.0.0) and white-label clients embedding the same liblumidevsdk.so library use hard-coded cryptographic keys (CWE-321). This allows an unauthenticated remote attacker to compromise confidentiality and integrity of data with a CVSS score of 9.1 (Critical).
The Aqara Cloud OAuth Authorization Endpoint (open-cn.aqara.com/oauth/authorize) is vulnerable to a redirect bypass due to lax controls on domain matching. This is an instance of CWE-1289: Improper Validation of Unsafe Equivalence in Input.
The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes unauthenticated bidirectional AES access to the platform's signing key. This is a missing authentication for a critical function and use of a risky cryptographic algorithm.
The Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api) would authorize any valid developer token for access to any account. This is a missing authorization (CWE-862) with a critical CVSS score of 9.6.
The Aqara IAM/SSO Gateway (gw-builder.aqara.com) uses a hardcoded OAuth client credential, violating CWE-798 (Use of Hard-coded Credentials). This vulnerability has an estimated CVSS score of 9.1 (Critical) and allows unauthenticated remote attacks.
The Pause+ mobile app has a vulnerability related to improper restriction of excessive authentication attempts, allowing authentication bypass.
A vulnerability in the jmespath.php library allows an attacker to execute arbitrary PHP code when using the `JmesPath\CompilerRuntime` with an attacker-controlled JMESPath expression. The compiler fails to properly escape function names, enabling injection of malicious code into the generated cache file, which is then executed.
Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to write arbitrary files to the store's media directory without authentication. Attackers can upload PHP files, potentially leading to remote code execution.
In vm2, prior to version 3.11.4, a sandbox escape vulnerability allowed arbitrary code execution in the host process when untrusted code was executed with async support. This issue has been patched in version 3.11.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS