CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.20)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Capgo before 12.128.2 contains an open redirect vulnerability in stripe_portal and stripe_checkout endpoints that accept unvalidated callbackUrl, successUrl, and cancelUrl parameters.
Capgo before 12.128.2 uses ILIKE pattern matching instead of exact matching for app_id lookup in the preview subdomain resolver. This allows underscore characters in app_id to act as SQL wildcards, potentially leading to unintended pattern matches.
Capgo before version 12.128.2 contains an authentication logic flaw that allows a user with permission to manage team or organization security settings to enable mandatory two-factor authentication for all team members without first enabling 2FA on their own account.
In versions 4.36.0 through 4.39.19, Authelia may skip an access control rule in specific cases of lack of domain canonicalization. An attacker could exploit this vulnerability to gain access to resources that should be protected.
Versions of Authelia from 4.38.0 to 4.39.19 have an issue with case sensitivity in usernames during Basic Auth authentication. As a result, different case variations can lead to the creation of separate ban buckets for the same user.
PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. In versions prior to 2.6.0, the public array `AbstractGenerator::$temporaryFiles` allows for the deletion of temporary files without verification, which can lead to unauthorized file deletions.
A vulnerability in NI grpc-device due to incorrect numeric type conversion in CodeGen, caused by missing range checks. This may silently discard high bits if a size value exceeds the target type's range.
HTML injection vulnerability in pgAdmin 4's cloud module allows injecting HTML code via crafted credentials. The flaw exists in /rds/, /azure/, /google/, and /cloud/ endpoints where SDK error messages are returned in JSON without HTML encoding, then rendered by the Cloud Wizard frontend. An authenticated user can inject a malicious iframe that redirects the victim to an external site.
A static credential embedded in Chef 360 prior to v1.7.0 permitted unauthenticated access to internal message queues. Queue messages contained tenant-specific identifiers.
A Reflected Cross-Site Scripting (XSS) vulnerability exists in LMS (LAN Management System) before commit 9c5651b in the 'dbrecover.php' and 'netremap.php' modules where unsanitized GET parameters are directly embedded into HTML output. This allows an attacker to inject arbitrary JavaScript when an authenticated user clicks a crafted link.
The UsersWP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 1.2.63. Authenticated attackers with editor-level access can reset or permanently delete the avatar or banner image of any arbitrary user.
In versions 4.0.0 to 4.1.0 of the Steeltoe.Configuration.Encryption library, configuring `encrypt:rsa:algorithm=OAEP` does not enable OAEP encryption due to an incorrect BouncyCastle transformation string. The `OAEP` setting selects the PKCS#1 v1.5 algorithm, which is equivalent to the `DEFAULT` setting.
The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location.
The docker_pull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint without validation. An attacker in a man-in-the-middle position could modify this header to redirect the authentication request to an arbitrary endpoint, potentially leaking authentication tokens.
In versions prior to 5.0.0, users can reset their MFA tokens via API routes that send them emails. The number of emails sent is not limited, allowing attackers to flood users' mailboxes.
Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket, causing responses to be delivered to the wrong requests.
snes9x version 1.63 allows an out-of-bounds write and denial of service via a crafted .ups file.
A vulnerability in undici allows the acceptance of incorrect SameSite attribute values in the Set-Cookie header, potentially leading to a weakening of the cookie's SameSite policy. Instead of the required case-insensitive exact match, values containing 'Strict', 'Lax', or 'None' as substrings are accepted.
Dell PowerFlex Manager versions prior to 5.1.0.1 contain an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. A low privileged attacker with adjacent network access could exploit this vulnerability, potentially leading to information disclosure.
Inappropriate implementation in Passwords in Google Chrome prior to version 149.0.7827.155 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page.