CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in the Net::SAML2 library for Perl (versions before 0.86) allows SAML authentication bypass. The _verify_encrypted_assertion function accepts a decrypted assertion without a signature, enabling an attacker to send an unsigned assertion encrypted with the SP's certificate and authenticate as any user.
Menulux Software Inc. Mobile App through version 12.05.2026 contains an authorization bypass vulnerability through a User-Controlled key, allowing a Software Integrity Attack.
An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) allows an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server. Successful exploitation could result in full compromise of the Security Management system.
In Wapt Server before version 2.6.1.17813, a remote unauthenticated attacker can bypass security restrictions using a specially crafted packet and retrieve a valid session token for the targeted account.
In Wavlink WL-NU516U1 (version 708c073-mt7628), the change_password function in nas.cgi has a stack-based buffer overflow via the User1Passwd argument. The attack can be executed remotely, and the exploit is publicly available.
In Wavlink WL-NU516U1 (version 708c073-mt7628), the fgets function in nas.cgi has a stack-based buffer overflow via the CONTENT_LENGTH argument. Remote exploitation is possible.
The 'Import and export users and customers' WordPress plugin before version 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing administrator's password or email.
The 'Link Library' WordPress plugin before version 7.9.3 does not properly sanitize and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
The 'ChamaWP' WordPress plugin before version 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.
The 'Personal QR Message' WordPress plugin through version 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution.
The 'Insert or Embed Articulate Content into WordPress' plugin through version 4.3000000027 does not correctly validate the contents of an uploaded archive, relying on a bypassable check that lets an Editor-level user upload a server-executable file into a public directory, resulting in remote code execution on servers configured to execute it.
The Simple Membership WordPress plugin before version 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account. This allows unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.
The SoftMarket — Digital Marketplace WordPress plugin through version 1.0.0 does not properly validate an authentication token in one branch of its email-verification flow. This allows unauthenticated attackers to obtain a valid session as any verified user by supplying only that user's ID.
The Super Store Finder WordPress plugin through version 7.8 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query. This allows unauthenticated attackers to perform SQL injection and extract data from the database.
The Webinfos WordPress plugin through version 1.2 does not validate the type or name of uploaded files, nor does it require authentication or a nonce check for the upload action. This allows unauthenticated attackers to upload arbitrary files (including PHP) to a web-accessible directory, leading to remote code execution on servers that execute PHP from the uploads path.
In Bouncy Castle for Java before 1.85, a Stapled OCSP response is accepted without binding to the checked certificate. This issue also affects LTS before 2.73.12 and FIPS before 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
In Bouncy Castle for Java before 1.85, Name Constraints can be bypassed via a trailing dot in rfc822Name and URI. This issue also affects LTS before 2.73.12 and FIPS before appropriate versions.
In Bouncy Castle for Java before 1.85, the MTI/A0 Diffie-Hellman key agreement exponentiates an unvalidated peer value. This issue also affects LTS before 2.73.12.
In Bouncy Castle for Java before 1.85, the JSSE hostname verifier enables CN-fallback by default despite documented opt-in. This issue also affects LTS and FIPS versions.
PyAthena prior to 3.35.4 contains a SQL injection vulnerability in DefaultParameterFormatter.format(). Unauthenticated attackers can inject arbitrary SQL by exploiting improper quote-escaping.