CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A security flaw has been discovered in Dolibarr up to 23.0.3. The unknown function in the User Cloning component of htdocs/user/card.php is affected. Manipulation of the ID argument results in LDAP injection. The attack can be launched remotely. The exploit has been publicly released and may be used. A patch is available.
A vulnerability was identified in OpenBoxes up to 0.9.6. The buildZebraTemplate function in DocumentController.groovy is affected, leading to improper neutralization of special elements used in a template engine. The attack can be initiated remotely. The exploit is publicly available. Upgrading to version 0.9.8-hotfix1 or 0.9.8 fixes the issue.
A vulnerability was found in OpenBoxes up to 0.9.7 in the Role Interceptor component, in the needManager function of RoleInterceptor.groovy. Manipulation can lead to improper privilege management. The attack can be performed remotely, and the exploit is publicly disclosed.
A vulnerability was found in OpenBoxes up to 0.9.7 in the Upload function of ProductController.groovy in the Product Upload Endpoint component. Manipulating the params.url argument results in server-side request forgery. The attack can be carried out remotely, and the exploit is public.
A vulnerability was detected in SourceCodester Stock Management System 1.0 in the file /classes/Master.php?f=delete_supplier. Manipulating the ID argument results in SQL injection. The attack can be launched remotely, and the exploit is public.
A weakness was identified in code-projects Online Shopping System 1.0 in the file /checkout_process.php. Manipulating the total_count argument can lead to SQL injection. The attack can be launched remotely, and the exploit is public.
A vulnerability was identified in code-projects Online Shopping System 1.0 in the file /homeaction.php. Manipulating the cat_id argument leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
A vulnerability was determined in code-projects Online Shopping System 1.0 in the file /action.php. Manipulating the proId argument causes SQL injection. The attack can be initiated remotely, and the exploit is publicly disclosed.
A vulnerability was found in SpaceX Starlink Router Gen 3 version 2025.11.14.mr64708.3 in the get_status function of the gRPC Management Interface component. The manipulation leads to improper access controls. The attack can only be initiated within the local network. The exploit is public, and the vendor did not respond.
A flaw has been found in code-projects Online Food Order System 1.0. An unknown function of the file delete_food_items1.php is affected. Manipulation of the argument checkbox leads to SQL injection. The attack can be executed remotely. The exploit has been published and may be used.
Shescape before 2.1.15 (and 3.0.0 before 3.0.2) fails to properly escape tilde (~) characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed to a command, an attacker can inject a tilde payload to disclose the user's home directory location and, depending on usage, alter the location on which a command operates.
SiYuan versions <= 3.7.3 (fixed in v3.7.4) contain a server-side template injection vulnerability in the attribute-view Template calculation feature (introduced in v3.7.0-beta.1). The feature's template engine uses Sprig's unmodified function map, which still exposes the env, expandenv, and getHostByName functions that were removed elsewhere for CVE-2024-55660. A local, unauthenticated attacker (the kernel binds to 127.0.0.1 by default with no per-UID access control) can inject a malicious Template calculation formula to read environment variables belonging to the account running siyuan — including from a separate, unprivileged OS account — and to perform DNS lookups from the server's network position.
A vulnerability has been found in SourceCodester Online Clothing Store 1.0. An unknown part of the file /db/shopping.sql of the component SQL Database Backup is affected. The manipulation leads to files or directories accessible. Remote exploitation is possible. The exploit has been disclosed to the public and may be used.
The @fastify/oauth2 plugin for Fastify, versions 7.2.0 up to but not including 8.3.0, improperly validates the OAuth state and PKCE code verifier by comparing callback query parameters against an unprefixed, predictable cookie, with no server-side binding to the browser. An attacker can set cookies and perform a login CSRF attack, silently signing the victim into the attacker's account. The fix in 8.3.0 adds an opt-in hostPrefixedCookies option.
In the itsourcecode Hospital Management System 1.0, a SQL injection vulnerability was found in the file /viewmedicine.php. Manipulation of the delid argument allows remote execution of SQL queries. The exploit has been published and may be used.
The WPML Multilingual CMS plugin for WordPress is vulnerable to SQL injection via the 'sorting' parameter in all versions up to and including 4.9.5 due to insufficient escaping and lack of preparation on the SQL query. This allows authenticated attackers with translator-level access and above to append additional SQL queries to extract sensitive information from the database.
The JSON plugin of Apache Struts is vulnerable to exposure of data element to wrong session. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the JSON interceptor is affected, which is not enabled by default; applications using the json result type are not affected.
A vulnerability in the JSON plugin of Apache Struts allows per-request parsing state to be shared across concurrent requests, potentially exposing data from one request to another and not enforcing configured parsing limits. Populating actions from JSON request bodies is not enabled by default, so applications not using the JSON plugin are unaffected.
The ECS WordPress plugin before version 4.3.8 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder. This allows users with a contributor-level account or above to read, alter, and delete the binding configuration of posts they do not own and to change the plugin's site-wide presets.
The Backup Migration WordPress plugin before version 2.1.7 does not properly restrict a post-restore automatic login mechanism. A user who administers one site of a multisite network can obtain a long-lived authenticated session as an administrator of another site in the same network, without credentials and bypassing two-factor authentication.