CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Templately versions up to 3.7.1. An attacker can inject a malicious script that executes in the victim's browser.
Unauthenticated CSRF vulnerability in Slider by 10Web versions up to 1.2.62. An attacker can exploit this to perform unwanted actions in the context of a logged-in administrator.
Unauthenticated XSS vulnerability in Fluent Forms Pro Add On Pack versions prior to 6.2.12. An attacker can inject malicious scripts that execute in the victim's browser.
Unauthenticated XSS vulnerability in Kirki versions up to 6.2.3. An attacker can inject malicious scripts that execute in the victim's browser.
Unauthenticated SQL Injection vulnerability in Depicter Slider versions up to 4.8.0. An attacker can inject malicious SQL queries into the database.
Unauthenticated XSS vulnerability in Ultimate Dashboard versions up to 3.11.2. An attacker can inject malicious scripts that execute in the victim's browser.
PHP Object Injection vulnerability in OptionTree versions up to 2.7.3, requiring editor privileges. An attacker can inject serialized PHP objects, potentially leading to arbitrary code execution.
Denial of service vulnerability in Expat through 2.8.3. The storeAtts() function in xmlparse.c has quadratic complexity, causing excessive CPU consumption when processing an XML document with many attributes with non-normalized values.
Use-after-free vulnerability in Valkey prior to versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1. The RESTORE command accepts a malformed RDB stream that assigns one NACK to multiple consumers, potentially allowing remote code execution.
Vulnerability in Dell Watchdog Timer Driver versions prior to 2.0.0.1. An exposed IOCTL with insufficient access control allows a low-privileged attacker to escalate privileges.
Vulnerability in Mastodon prior to versions 4.4.19 and 4.5.12. The ldap_authenticable.rb file mutates global OpenSSL parameters when LDAP uses LDAP_TLS_NO_VERIFY=true, disabling SSL/TLS certificate verification for puma web processes.
Valkey, a distributed key-value database, contains a use-after-free vulnerability in the tlsProcessPendingData function. An authenticated client can trigger CLIENT KILL, causing deletion of a node from the list and potentially leading to server crash or remote code execution when TLS is enabled. The issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.
Oh My Zsh, a framework for managing Zsh configuration, has a vulnerability in the dotenv plugin. After changing to a directory containing a .env file, its contents are executed as shell commands with the current user's privileges, even without a prompt when ZSH_DOTENV_PROMPT=false or after default confirmation. The issue is fixed in versions released after 2026-05-28.
goshs, a simple HTTP server written in Go, does not enforce mode-restriction flags (--read-only, --upload-only, --no-delete) on the WebDAV port when WebDAV is enabled (-w). An authenticated WebDAV client can perform PUT, DELETE, MKCOL, MOVE, and COPY operations despite the operator's intent. The issue is fixed in version 2.1.0.
SSH.NET, an SSH library for .NET, has a vulnerability in ScpClient.Download that trusts file and directory names returned by a remote SCP server. A malicious or compromised server can use ../ sequences or absolute paths to create or overwrite files anywhere writable by the client process. The issue is fixed in version 2026.0.0.
Trilium Notes, a hierarchical note-taking application, has an XSS vulnerability in the #iconClass value, which is inserted without HTML attribute encoding. A stored payload can execute automatically when a victim opens a new tab or uses Ctrl+J, and due to enabled nodeIntegration and disabled contextIsolation in Electron, it can run operating-system commands. The issue is fixed in version 0.103.0.
OttoKit versions up to 1.1.35 contain an unauthenticated Server Side Request Forgery (SSRF) vulnerability. An attacker can send requests from the server to internal resources.
ThumbPress versions prior to 6.5 contain an unauthenticated Broken Access Control vulnerability. Unauthenticated users can perform operations they are not authorized to do.
BP Better Messages versions up to 2.15.22 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
Ezoic versions up to 2.22.11 contain an unauthenticated Broken Authentication vulnerability. An attacker can bypass authentication mechanisms and gain unauthorized access.