CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. Affects versions 8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3.
Apache Traffic Server is vulnerable to request smuggling when chunked messages are malformed. This affects versions from 8.0.0 to 8.1.9, from 9.0.0 to 9.2.14, and from 10.0.0 to 10.1.3.
Apache Traffic Server has an Improper Access Control vulnerability. This affects versions from 9.0.0 to 9.1.14 and from 10.0.0 to 10.1.3.
Apache Traffic Server has an Improper Input Validation vulnerability. This affects versions from 9.2.0 to 9.2.14 and from 10.1.0 to 10.1.3.
The Vacron VIN-DS783E-E6 device has a Hidden Functionality vulnerability, allowing unauthenticated remote attackers to exploit a specific hidden function to obtain administrator credentials.
Koollab LMS has a SQL injection and unsafe deserialization vulnerability in the manual mark assessment endpoint. An authenticated attacker can inject SQL, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.
Koollab LMS has a SQL injection and unsafe deserialization vulnerability in the assessment overall answer endpoint. An authenticated attacker can inject SQL, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.
Koollab LMS has a SQL injection and unsafe deserialization vulnerability in the assessment reinforcement endpoint. An authenticated attacker can inject SQL, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.
Koollab LMS has a pre-authentication error-based SQL injection vulnerability in the SCORM report endpoint. An unauthenticated attacker can read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens, potentially enabling account takeover.
Koollab LMS has a pre-authentication blind SQL injection vulnerability in the SSO OAuth endpoint. An unauthenticated attacker can use a time-based SQL oracle to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens, potentially enabling account takeover.
Koollab LMS has an unrestricted SCORM file upload vulnerability. An authenticated module designer can upload a SCORM package containing a PHP webshell to a publicly accessible directory and execute arbitrary code on the server.
The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes. This allows unauthenticated attackers to call arbitrary PHP functions with attacker-supplied arguments, leading to privilege escalation and remote code execution.
The Advanced Responsive Video Embedder plugin for WordPress version 10.8.7 contains a hardcoded backdoor. The `_arve_uc_init()` function compares a token from the `_wplogin` parameter against a hardcoded SHA-256 hash, with no authentication checks. This allows an unauthenticated attacker to log in as any administrator.
In goshs file server before version 2.1.4, the WebDAV MOVE method handling did not enforce the --no-delete option, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T.
In goshs from version 2.1.3 to 2.1.4, the SFTP password handler only checked that username and password are not empty, so running with -b 'admin:' -sftp and without -fkf left both SFTP authentication handlers unset, allowing unauthenticated file access.
In Hypequery before 2.5.1, escapeValue() did not escape backslashes before single quotes during parameter substitution, allowing SQL injection via trailing backslash. Fixed in 2.0.2 for string parameters, but 2.5.1 is the complete fix.
In the Giving Reports functionality in Ellucian Advance Web and Legacy Advance, a SQL injection vulnerability allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field.
IBM Aspera Desktop App versions 1.0.5 through 1.0.19 allow files to be written outside of the user's selected download destination.
IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4 allow a remote authenticated attacker to execute arbitrary code via shell command injection.
IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4 allow a remote authenticated attacker to execute arbitrary code via unquoted shell interpolation.