CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in the Agent Development Kit (ADK) allows continuation forgery in tool confirmations. An attacker who can manipulate session history events can execute unauthorized tools by forging a confirmation response. The framework did not verify if the tool was registered, required confirmation, or matched the original call arguments.
Coverity Connect versions between 2023.6.0 and 2026.3.0 have a Spring Security authentication and authorization bypass vulnerability. An unauthenticated attacker can send a crafted HTTP request to access data within Coverity.
Logging operator before version 6.6.0 has a command injection vulnerability in the Fluentd configuration renderer. A user who can create Flow resources can inject a <match **> block with @type exec to execute arbitrary commands in the Fluentd aggregator.
Xlight FTP Server before version 3.9.5 has a pre-authentication heap buffer overflow vulnerability. A remote unauthenticated attacker can send a malformed SSH client identification string to write past the end of a heap buffer. A logic error in the recv loop enables exploitation before authentication.
AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before version 2.2.2 has a missing authentication vulnerability in the Space Link Extension (SLE) interface manager. An unauthenticated network attacker can access seven unprotected API routes to manage communication sessions, retrieve telemetry data, and inject frames into active links.
AMMOS Instrument Toolkit (AIT) GUI before version 2.5.1 has a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create() without credential checks.
Prebid Server before version 4.4.0 has a vulnerability in certain bidder adapters that interpolate user-supplied parameters into outbound request URLs without proper validation of host and subdomain values. This can cause requests to unintended destinations.
The Joomla extension Gridbox before version 2.20.2 has an account takeover vulnerability. The socialLogin method allows an attacker to log in as any user on the target site.
Joomla Extension Gridbox below version 2.20.2 has a vulnerability allowing an unauthenticated attacker to reset any user's password (excluding super admins). This allows logging in and acting as those users.
Axway SecureTransport version 5.5-20260326 and earlier has a Server-Side Template Injection (SSTI) vulnerability in the email template functionality. An attacker with admin privileges can inject Java code executed during template rendering, leading to full host compromise.
Joomla Extension Gridbox below version 2.20.2 has multiple SQL injection vectors allowing an unauthenticated attacker to inject SQL queries.
Joomla Extension Gridbox below version 2.20.2 has a privilege escalation vulnerability. The registration method allows users to provide usergroup IDs, enabling an unauthenticated attacker to register an account with administrative permissions.
A CWE-754 vulnerability (improper check for unusual or exceptional conditions) exists in Modbus TCP communication, which can lead to remote code execution, denial of service, and loss of confidentiality and integrity.
Joomla Extension Aimy Captcha-Less Form Guard 18.0-20.0 is vulnerable to PHP object injection via a forged clfgd field, leading to remote code execution.
Cost Calculator Builder PRO plugin for WordPress up to 4.0.3 is vulnerable to RCE via js_to_php function. The orderDetails[*].originalValue field is injected into a formula passed to eval(), with insufficient sanitization. Unauthenticated attackers can obtain the nonce from the front-end and execute code on the server.
Meta Box AIO plugin for WordPress up to 3.8.0 (with MB Frontend Submission) lacks authorization in the template_redirect dispatcher. The handle_request() function routes the mbfs_delete action without capability checks, and nonce verification is bypassed because is_ajax() returns false for template_redirect requests. Unauthenticated attackers can delete arbitrary posts and pages by supplying a post ID via the rwmb_frontend_field_object_id parameter.
In FAB auth manager, `verify_signature=False` is the default when decoding ID tokens in Azure AD OAuth login. An attacker can present a forged token (e.g., with 'alg:none') and log in as any user, including Admin.
The certifier plugin in Apache Traffic Server generates certificates based on attacker-controlled client SNI. Affects versions 8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3.
Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress up to 2.4.37 lacks authorization in the user_filter function, allowing unauthenticated attackers to create admin accounts.
Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. Affects versions 8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3.