CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In RustFS prior to version 1.0.0-beta.2, a vulnerability exists in the PUT /rustfs/admin/v3/import-iam endpoint. Improper validation allows a user with ImportIAMAction to create service accounts under arbitrary parent identities, including the root user (minioadmin). An attacker can set their own credentials, leading to privilege escalation to full administrative access.
DreamMaker by Interinfo has an arbitrary file upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, leading to arbitrary code execution on the server.
A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the validation logic allows file paths to escape the intended temporary directories. An authenticated user with campaign import privileges can write arbitrary PHP files to sensitive system directories, leading to Remote Code Execution (RCE) under the web server user context.
A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') was identified in the Console WebUI of Waterfall WF-500 TX and RX Hosts version 7.9.1.0 R2502171040, allowing remote unauthenticated attackers to execute arbitrary operating system commands on the device.
A CWE-78 OS Command Injection vulnerability was identified in the Console WebUI of Waterfall WF-500 TX and RX Hosts version 7.9.1.0 R2502171040. It allows remote unauthenticated attackers to execute arbitrary operating system commands on the device.
A CWE-78 OS Command Injection vulnerability was identified in the Console WebUI of Waterfall WF-500 TX and RX Hosts version 7.9.1.0 R2502171040. It allows remote unauthenticated attackers to execute arbitrary operating system commands on the device.
A CWE-78 OS Command Injection vulnerability was identified in the Console WebUI of Waterfall WF-500 TX and RX Hosts version 7.9.1.0 R2502171040. It allows remote unauthenticated attackers to execute arbitrary operating system commands on the device.
A CWE-288 authentication bypass vulnerability in the Console WebUI of Waterfall WF-500 TX and RX hosts version 7.9.1.0 R2502171040 allows remote unauthenticated attackers to bypass authentication and perform actions as an authenticated user.
A CWE-78 OS Command Injection vulnerability was identified in the Console WebUI of Waterfall WF-500 TX and RX Hosts version 7.9.1.0 R2502171040. It allows remote unauthenticated attackers to execute arbitrary operating system commands on the device.
A CWE-78 OS Command Injection vulnerability was identified in the Console WebUI of Waterfall WF-500 TX and RX Hosts version 7.9.1.0 R2502171040. It allows remote unauthenticated attackers to execute arbitrary operating system commands on the device.
A CWE-78 OS Command Injection vulnerability was identified in the Console WebUI of Waterfall WF-500 TX and RX Hosts version 7.9.1.0 R2502171040. It allows remote unauthenticated attackers to execute arbitrary operating system commands on the device.
A CWE-23 Relative Path Traversal vulnerability in the Administration WebUI of Waterfall WF-500 TX and RX Hosts version 7.9.1.0 R2502171040 allows remote unauthenticated attackers to delete arbitrary files on the host machines.
A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions, allowing authenticated users with theme creation or upload permissions to achieve remote code execution (RCE) and access restricted system files and configuration.
The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor injection.
The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system access.
Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device.
Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requests when Base64 decoding fails.
The OTP Login With Phone Number, OTP Verification plugin for WordPress versions 1.8.50 through 1.8.60 contains an authentication bypass vulnerability. The Firebase verification flow in the `lwp_ajax_register` AJAX handler does not bind the Firebase session to the phone number supplied in the request, allowing attackers to authenticate as any user with a stored phone number, including administrators.
The WP Maps Pro plugin for WordPress up to version 6.1.0 contains a privilege escalation vulnerability via administrator account creation. Unauthenticated attackers can exploit the wpgmp_temp_access_ajax AJAX action, protected only by a nonce publicly embedded on every page, to create a new user with administrator role and take over the entire site.
An out-of-bounds write vulnerability in the GPU component of Google Chrome prior to version 148.0.7778.216 allows a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS