CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated SQL Injection vulnerability in Simply Schedule Appointments versions up to 1.6.12.10.
Unauthenticated Privilege Escalation vulnerability in AIWU versions up to 1.5.6.
Sensitive Information Disclosure vulnerability in Dell Virtual Storage Integrator for VMware vSphere Client prior to version 10.11.1.0. An unauthenticated remote attacker could exploit this, leading to information disclosure and session hijacking.
Path traversal vulnerability in OpenChamber 1.11.7 in file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw, allowing unauthenticated remote attackers to read arbitrary files by supplying allowOutsideWorkspace=true and an absolute path, bypassing workspace boundary check.
Unauthenticated remote code execution vulnerability in OpenChamber 1.11.7, allowing remote attackers to execute arbitrary shell commands by sending crafted POST requests to /api/fs/exec, which passes commands verbatim to Node.js spawn() without validation.
An SQL Injection vulnerability exists in Apache Portable Runtime Utility via the apr_dbd_oracle provider. This issue affects versions from 1.6.0 through 1.6.3.
A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue.
Unauthenticated PHP Object Injection vulnerability in Ajax Search Lite versions up to 4.14.4.
Unauthenticated Privilege Escalation vulnerability in Kadence WooCommerce Email Designer versions up to 1.5.19.
SQL Injection vulnerability in Loca Software Informatics Technology Ltd. Co. CMS due to improper neutralization of special elements in an SQL command. The issue affects CMS through 06082026.
In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if the victim is authenticated into the Admin Console, leading to full unauthenticated takeover of the GlassFish domain until the token expires.
In Apache CXF's DefaultEncryptingCodeDataProvider, an authorization code can be redeemed an unlimited number of times due to a flaw in the removeCodeGrant implementation. This violates the RFC requirement that the authorization code must not be used more than once. Users are advised to upgrade to versions 4.2.3, 4.1.8, or 3.6.12.
Apache CXF's OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. Note that self-issued ID tokens are not accepted by default. Users are advised to upgrade to versions 4.2.3, 4.1.8, or 3.6.12.
Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT can substitute code_challenge, code_challenge_method, nonce, and state values, undermining PKCE integrity and OpenID Connect replay protection. Users are advised to upgrade to versions 4.2.3, 4.1.8, or 3.6.12.
In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at registration time. Users are advised to upgrade to versions 4.2.3, 4.1.8, or 3.6.12.
Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remote code execution. The fix disables ObjectMessage deserialization by default, with a configuration switch to re-enable it if needed.
In the Linux kernel, the SMB client has a double-free vulnerability in SMB2_close() during replay. If a response-bearing attempt returns a replayable error and frees its response buffer, and then SMB2_close_init() fails before the next send, the buffer is freed again.
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. An attacker can craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.
Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. A low-privileged user can invoke Admin REST APIs of WSO2 products.
The Conditional Authentication script does not correctly enforce the completion of all required authentication steps in a specific multi-step pattern. An attacker can bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution.