CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions return true when the user ID matches but fail to reject the null/zero reference, enabling bypass.
A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option.
An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The wiki-cache endpoint constructs file paths from user-controlled fields without sanitization, enabling path traversal.
A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator.
An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource.
Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.
Remote Code Execution via Arbitrary Class Instantiation in the plugin-schema-registry component in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0.
Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0.
Privilege Escalation via URL Parameter in Apache Ranger versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0.
SQL Injection vulnerability in Apache Ranger. Users are recommended to upgrade to version 2.9.0, which fixes the issue.
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger, affecting versions from 0.6 through 2.8.
The Joomla extension Fabrik before version 4.6.9 contains a remote code execution vulnerability. An unauthenticated attacker can execute arbitrary code by using the ajax_calc feature of the calc plugin.
The Product Input Fields for WooCommerce plugin before version 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files. This allows unauthenticated attackers to upload arbitrary files and achieve remote code execution on servers that do not honor the directory's access rules.
The ProSolution WP Client plugin before version 2.0.6 does not sanitize and escape a parameter before using it in a SQL statement reachable by unauthenticated visitors, leading to a blind SQL injection.
The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.
The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.
A security flaw in Shenzhen Aitemi M300 Wi-Fi Repeater allows command injection via the sprintf function in /protocol.csp. Manipulating enable/name/mac arguments enables remote command execution. The exploit is public.
The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
The InfiniteWP Client WordPress plugin before version 1.13.6 improperly verifies the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations. This allows unauthenticated attackers to bind their own key, hijack an administrator session, and take over the entire network, leading to remote code execution.
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the openvpn function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the macfilter function to inject malicious commands and obtain root privileges on the underlying system.