CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In the adhoc_connect_server function in pgAdmin 4 9.0-9.16, when a non-owner user clones a server, all columns including credentials (passwords) and ownership flags are copied. This allows an attacker to take over the cloned server and use database passwords belonging to another user (e.g., an administrator).
Deployment of the VPS.org one-click Zulip template includes a hardcoded application signing key, a default database password ("zulip"), and DISABLE_HTTPS=True.
Deployment of the VPS.org one-click Supabase template runs a PostgreSQL instance listening on all interfaces (0.0.0.0:5432) with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration.
A Code Injection vulnerability in Logsign SIEM (before 6.4.115) allows code injection.
PHP Jabbers Car Rental Script before version 4.1 contains a SQL injection vulnerability in sorting parameters, allowing an unauthenticated attacker to perform SQL injection attacks.
DMS+ (Non-Mobile) by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over all installed DMS+ devices.
The ShopMonitor.io WordPress plugin before version 1.2.0 improperly restricts its email-rerouting test mode, relying on client-supplied request headers. Unauthenticated attackers can redirect outgoing emails, including the WordPress administrator password-reset email, to an address they control and take over the administrator account.
The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0. Missing file type validation combined with a publicly accessible I/O endpoint authenticated solely by static default API credentials allows unauthenticated attackers to upload executable files, leading to remote code execution.
CodeIgniter prior to 4.7.4 has a vulnerability in the is_image and mime_in upload validation rules that do not enforce a safe client filename extension. A remote attacker can upload executable content if the application preserves the client filename and stores uploads in a web-accessible script-enabled directory.
CodeIgniter from 4.3.0 through 4.7.3 has a vulnerability in the Query Builder deleteBatch() method that substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing SQL injection.
Full details and mitigation steps are currently restricted and will be published at a later date.
In Google mcp-toolbox versions v1.3.0 and v1.4.0, incorrect authorization in the direct HTTP API tool invocation endpoint allows an unauthenticated attacker to invoke tools protected by scopeRequired via legacy HTTP endpoints when the --enable-api flag is active.
OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages.
Multiple router models (TR1200, TR3000, WR300, etc.) contain a command injection vulnerability in the net.set_wan interface. Attackers can execute arbitrary commands as root via crafted input.
LazyOwn RedTeam/APT Framework ships default C2 credentials in configuration files, allowing any network-reachable attacker to authenticate to the C2 dashboard with operator-level access.
LazyOwn RedTeam/APT Framework registers an unauthenticated Socket.IO input event handler that dispatches data to a function executing system commands, allowing unauthenticated remote code execution.
Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.
OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads via a crafted username in a failed login request, which is rendered unsanitized in the administrator's notification panel.
Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret. When the OST_TOKEN_SECRET environment variable is not set, the application falls back to a default value publicly visible in the source code repository.
A vulnerability in dnsmgr version 2.15 and earlier allows a local attacker to execute arbitrary code via the ping function in the CheckUils.php file.