CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in OpenReception (before 1.0.2) in WebAuthn registration allows an unauthenticated attacker to associate their own credential with a victim's account by manipulating the userId parameter in the URL. The validation does not check that the userId belongs to the email in the cookie.
A vulnerability in OpenReception's appointment booking software allows a TENANT_ADMIN to promote themselves or another staff member to the platform-wide GLOBAL_ADMIN role via a single PUT request. There is no policy check enforcing that only an existing GLOBAL_ADMIN can grant GLOBAL_ADMIN, so schema validation acts as the authorization decision. After re-login, the tenant admin gains full access to all other tenants on the platform.
OpenReception's appointment booking software before version 1.0.1 allows an unauthenticated attacker to create a GLOBAL_ADMIN account by sending a POST request to `/setup/create-admin-account`, without verifying that an admin already exists. The attacker gains full administrative control over the platform, and the new account is active and does not require email confirmation.
A vulnerability in the System REST API allows authenticated users with publisher privileges to upload files to arbitrary server-accessible locations due to insufficient validation of file type and destination. This could lead to code execution.
Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109. A remote attacker could exploit a crafted HTML page to potentially perform a sandbox escape.
Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109. A remote attacker could exploit a crafted HTML page to potentially perform a sandbox escape.
Use after free in Web Authentication in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Insufficient validation of untrusted input in Codecs in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Out of bounds write in ANGLE in Google Chrome on Android prior to 151.0.7922.109. A remote attacker could potentially perform a sandbox escape via a crafted HTML page.
Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109. A remote attacker could potentially perform a sandbox escape via a crafted HTML page.
A privilege escalation vulnerability in Sophos Endpoint for macOS (before 2026.1.1) and Sophos Home for macOS (before 10.11.6) allows local users to execute arbitrary code as root.
Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites.
A Server-Side Template Injection (SSTI) vulnerability in WGDashboard version 4.3.2 and earlier allows authenticated attackers to execute arbitrary code as root.
A Remote Code Execution (RCE) vulnerability exists in WGDashboard version 4.2.3 and earlier. Multiple OS command injection allows authenticated attackers to execute arbitrary commands as root.
A Server-Side Request Forgery (SSRF) vulnerability exists in WGDashboard version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to make arbitrary HTTP requests and retrieve responses.
The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end script/content injection, giving an unauthenticated attacker full control of the affected site.
The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both the current release (10.2.2) and the version MonsterInsights rolled back to (10.2.0) contain a malicious file, `class-system-check.php`. Three distinct variants were observed on 2026-06-11, all sharing the same AES-256-GCM key, confirming a single threat actor. The attacker retains write access to the S3 bucket and has been actively iterating on the payload throughout the day.
In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could exploit this to execute arbitrary OS commands with root privileges on the underlying operating system. Exploitation may lead to a complete system takeover.