CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The product firmware contains an embedded, static RSA private key used by the Lighttpd web server for TLS termination. Exposure of this key allows attackers to breach HTTPS confidentiality and integrity, enabling traffic decryption and server spoofing.
In the Linux kernel, a use-after-free vulnerability exists in SCTP's ASCONF processing. An attacker can send a crafted ASCONF packet that frees the transport used for processing, then leverages the dangling pointer, leading to memory corruption and potential code execution.
The Improve SEO WordPress plugin through version 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory. This allows unauthenticated users to upload executable PHP files and achieve remote code execution.
The Easy Integration for Dropbox WordPress plugin before version 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that are also registered for unauthenticated users. This allows an unauthenticated attacker to list, download, and upload arbitrary files on the connected Dropbox account and to read the connected account and administrator email addresses.
A vulnerability was detected in GL.iNet GL-MT3000 up to version 4.4.5. It affects the nas-web.add_user function in the /cgi-bin/glc file of the nas-web RPC Wrapper component. Manipulation leads to command injection, and the attack can be initiated remotely. The exploit is public and may be used.
A security vulnerability has been detected in GL.iNet GL-MT3000 up to version 4.4.5. It affects the set_upgrade function in the /cgi-bin/glc file of the modem.so component. Such manipulation leads to command injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be used.
Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could lead to privilege escalation. Exploitation does not require user interaction.
Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to privilege escalation. Exploitation does not require user interaction, and the scope is changed.
Adobe Campaign Classic (ACC) is affected by an SQL Injection vulnerability that could lead to arbitrary code execution in the context of the current user. An attacker can execute arbitrary SQL commands, potentially gaining elevated access. Exploitation does not require user interaction, and the scope is changed.
Adobe Campaign Classic (ACC) is affected by an SQL Injection vulnerability that could lead to arbitrary code execution in the context of the current user. A low-privileged attacker can exploit this to execute arbitrary code. Exploitation does not require user interaction, and the scope is changed.
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could lead to arbitrary code execution in the context of the current user. An attacker can exploit this to execute arbitrary code. Exploitation does not require user interaction, and the scope is changed.
Adobe Campaign Classic (ACC) is affected by an Eval Injection vulnerability that could lead to arbitrary code execution in the context of the current user. A low-privileged attacker can exploit this to execute arbitrary code. Exploitation does not require user interaction, and the scope is changed.
GL.iNet GL-MT3000 router up to version 4.4.5 contains a command injection vulnerability in the remove_profile function in /cgi-bin/glc of the modem.so component. The attack can be performed remotely, and the exploit is publicly available.
Tenable Sensor Proxy contains a vulnerability that allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host.
Misskey, an open source federated social media platform, has a vulnerability in the JSON-LD signature validation and compaction process that allows spoofed activities to be accepted as valid.
Sequelize, a Node.js ORM tool, is vulnerable to SQL injection in the Oracle dialect. The escape function fails to escape quotes when the value starts with TO_TIMESTAMP or TO_DATE, allowing arbitrary SQL injection.
An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commands as root via injecting shell metacharacters.
SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to execute arbitrary code via the application/common/controller/Backend.php component.
The "s init" command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input to child_process.spawn() with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument.
Baileys, a socket-based TS/JavaScript API for WhatsApp Web, has a vulnerability that allows a malicious payload via placeholderResendMessage to trigger fake messages.upsert events, enabling message spoofing and app state sync corruption.