CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Single Sign On For TNG plugin for WordPress is vulnerable to authentication bypass via unauthenticated password reset. The `ssoprocess_ajax()` function accepts an `email` parameter and calls `reset_password()` without any ownership token or email confirmation. The only guard is a nonce that is publicly broadcast on every page, allowing an attacker to capture it and change any account's password, including administrator accounts.
The Participants Database WordPress plugin before version 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query. This allows unauthenticated attackers to perform SQL injection attacks.
The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on a REST API endpoint. Unauthenticated attackers can delete arbitrary files in the formgent uploads directory, and on Linux servers, if the directory does not exist, they can bypass path traversal protection and delete files like wp-config.php.
ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node. An unauthenticated attacker can upload a crafted pickle file via the POST /upload/image endpoint and trigger its deserialization via POST /prompt, leading to arbitrary Python code execution through torch.load.
libiec61850 version 1.6 contains a vulnerability in the parseGoosePayload() function in /goose/goose_receiver.c, allowing attackers to bypass authentication via a captured GOOSE frame.
sentence-transformers contains a security control bypass vulnerability in the import_module_class helper in util/misc.py. The condition 'or os.path.exists(model_name_or_path)' allows code execution from Python files placed in a local model directory even when trust_remote_code=False. An attacker who can influence the model directory contents can place malicious files that execute when the model is loaded.
Hugo Leisink Hiawatha version 12.1 and earlier contains a vulnerability that allows a remote attacker to execute arbitrary code via a crafted request.
Routers TR1200, TR3000, WR300, WR1200, WR1300, WR1500, WR3000, WR3600, and WR6500 with specific firmware versions contain a command injection vulnerability in the ipsec_conn interface. Attackers can execute arbitrary commands as root via crafted input.
Routers TR1200, TR3000, WR300, WR1200, WR1300, WR1500, WR3000, WR3600, and WR6500 with specific firmware versions contain a command injection vulnerability in the system.setclock interface. Attackers can execute arbitrary commands as root via crafted input.
SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/delete_group.php?id=1. Attackers can manipulate the id parameter to execute unauthorized SQL queries.
SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters district_id, division_id, region_id, and ward_id. Attackers can inject malicious SQL queries.
Routers TR1200, TR3000, WR300, WR1200, WR1300, WR1500, WR3000, WR3600, and WR6500 with specific firmware versions contain a command injection vulnerability in the system.upgrade_check interface. Attackers can execute arbitrary commands as root via crafted input.
vault-secrets-webhook versions before 1.23.1 contain a vulnerability that allows sending a ServiceAccount JWT token to an attacker-controlled Vault address. The parseVaultConfig() function accepts the vault.security.banzaicloud.io/vault-addr annotation, and MutateConfigMap and MutateSecret call newVaultClient, which can cause the token to be sent to an unsafe server.
In Johnson Controls FM Systems Employee before version 2025.3.1, there is an unrestricted upload of file with dangerous type vulnerability, allowing the use of malicious files.
The Tenda W6-S device version 1.0.0.4(510) has a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The formwrlSSIDset function uses sprintf to copy user-controlled 'GO' and 'index' parameters into a 64-byte stack buffer without length restriction, leading to stack overflow.
Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.
Wings, the server control plane for Pterodactyl, prior to 1.12.3 allows a low-privileged user to read sensitive configuration data (token, token_id, Docker registries) via {{config.}} placeholders in egg configuration-file templates.
A vulnerability in pgAdmin 4 allows remote code execution (RCE) via injection into the Import/Export Data tool. The validation function incorrectly handles backslashes in SQL strings, enabling bypass of protections and addition of a TO PROGRAM clause to psql commands.
A vulnerability in pgAdmin 4 (versions 9.13 to 9.16) allows bypassing the CVE-2026-12045 fix by injecting SQL queries into the AI assistant. An attacker can plant a malicious payload in an object read by the assistant, leading to execution of multiple SQL statements, including write or remote code execution.
In the adhoc_connect_server function in pgAdmin 4 9.0-9.16, when a non-owner user clones a server, all columns including credentials (passwords) and ownership flags are copied. This allows an attacker to take over the cloned server and use database passwords belonging to another user (e.g., an administrator).