CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.
@jshookmcp/jshook is an MCP server that gives AI agents tools for JavaScript analysis and security research. In version 0.3.1, the network domain has a central SSRF authorization policy that blocks private, loopback, link-local, and reserved targets unless an explicit authorization object allows private network access. The policy is enforced by raw HTTP/TCP/TLS RTT tools, but the ICMP probe and traceroute tools resolve the target and invoke the native ICMP/traceroute sink directly. An MCP client with access to an active network domain can therefore ask the jshookmcp server to probe internal addresses even when local SSRF access is disabled for the other raw network tools. This exposes an internal reachability and route mapping primitive from the server network position. Version 0.3.2 fixes the issue.
In Probo, the `saferedirect` package improperly validated redirect URLs by only inspecting the second character of relative paths. A URL like `/../\evil.com` passed validation, and browsers could interpret the backslash as a host separator, redirecting users to an external domain. This enables open-redirect phishing attacks.
ELAN reported a potential out-of-bounds write vulnerability in the ELAN TrackPoint driver that, under certain circumstances, could allow a local authenticated user to cause a system crash.
Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions.
Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.
Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions.
Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions.
Unauthenticated Broken Access Control vulnerability in GiveWP plugin versions prior to 4.16.6.
Author-level Cross Site Scripting (XSS) vulnerability in WP Data Access plugin versions up to and including 5.5.79.
Contributor-level Cross Site Scripting (XSS) vulnerability in Featured Image from URL plugin versions up to and including 5.3.3.
In basecamp/upright at a specific commit, Rails CSRF protection is disabled for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management endpoints, such as creating an Alertmanager silence or requesting a Prometheus reload. The final impact depends on the APIs enabled by the upstream services.
Subscriber-level Broken Access Control vulnerability in Motors plugin versions up to and including 1.4.113.
Unauthenticated Broken Access Control vulnerability in Anti Spam and list cleaner – AcyChecker plugin versions up to and including 2.0.0.
Customer-level Cross Site Scripting (XSS) vulnerability in WpBookingly plugin versions up to and including 1.3.2.
Unauthenticated Broken Access Control vulnerability in Contact Form 7 – PayPal & Stripe Add-on plugin versions up to and including 2.5.1.
Subscriber-level Server Side Request Forgery (SSRF) vulnerability in Vehica Core plugin versions up to and including 1.0.104.
Subscriber-level Cross Site Scripting (XSS) vulnerability in Accordion plugin versions up to and including 3.0.6.
Cross Site Scripting (XSS) vulnerability in FluentCommunity versions up to 2.7.5, exploitable by a user with Subscriber role.
Broken Access Control vulnerability in Internal Link Optimiser versions up to 5.2.7, exploitable without authentication.