CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
IBM WebSphere Application Server 9.0 and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization, which could allow a remote attacker to bypass authentication or execute arbitrary code.
IBM WebSphere Application Server 9.0 and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console.
In pglogical, when applying replicated changes for a row with missing columns, the table's default expressions are evaluated on the subscriber. The apply worker runs with PostgreSQL superuser privileges, so functions invoked by default expressions also run with those privileges. A publisher can use this path to escalate to superuser on the subscriber.
The pglogical queue mechanism executes message payloads on the subscriber with PostgreSQL superuser privileges. A publisher can send crafted messages to execute arbitrary SQL as superuser, escalating privileges and breaking tenant isolation.
Terraform-mcp-server before version 1.1.0 is vulnerable to cross-tenant credential reuse in streamable-HTTP mode, allowing one user's Terraform token to be used for tool calls on behalf of other users.
Pivotick contains a DOM-based XSS vulnerability in UI element resolution and icon-rendering utilities. The tryResolveHTMLElement function treats any resolved string as HTML markup, and createIcon inserts SVG icons without sanitization. An unauthenticated attacker can provide a crafted graph, property value, or SVG icon, leading to JavaScript execution in the victim's browser.
Apache Axis2/Java up to version 2.0.0 has a deserialization vulnerability in the Tribes clustering component on Tomcat (disabled by default). An unauthenticated remote attacker with network access to the cluster port can deliver a crafted serialized Java object, leading to arbitrary code execution. The issue is fixed by removing the clustering feature in version 2.0.1.
The Joomla extension Balbooa Forms versions below 2.4.3 are vulnerable to unauthenticated remote code execution. Insecure form processing logic allows code execution for forms that include the signature field type.
In PROCON-WEB SCADA, the 'GetGridData' endpoint is not properly sanitized. This allows a remote unauthenticated attacker to execute arbitrary SQL commands.
In AppEngine, file access over HTTP is improperly restricted, allowing an unauthenticated attacker to read and write sensitive filesystem areas. A critical directory was exposed, including device parameter files, enabling reading and modification of application settings and customer passwords. Additionally, access to the custom application directory may allow execution of arbitrary Lua code in the AppEngine environment.
The SMS Alert plugin for WordPress up to version 3.9.7 is vulnerable to authentication bypass leading to account takeover. The processRegistration() function uses a session flag $_SESSION['sa_mobile_verified'] as the sole gate before issuing an authentication cookie, but the flag is not bound to a specific phone number. An attacker can verify their own number, then submit a registration request with the victim's number, resulting in authentication as any existing WordPress user, including administrators.
A deserialization of untrusted data vulnerability in the Station Launcher App in 3DEXPERIENCE platform from Release R2023x through R2026x could lead to unauthenticated remote code execution.
The TrueBooker WordPress plugin before version 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers. This allows unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.
In Quest KACE SMA 11.0.273, the rate-limiting feature for API endpoints can be bypassed by removing the kboxid cookie, enabling brute-force attacks.
Quest KACE SMA 11.0.273 uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL database. The key is not unique per installation, so an attacker with access to the MySQL server or backups can decrypt the secrets.
In Quest KACE SMA 11.0.273, access restrictions to the web console (e.g., by IP address) do not apply to API endpoints. If an attacker knows credentials or API keys, they can access the appliance via the API, potentially compromising the entire environment.
A stored XSS vulnerability in the capture tree visualization tool. Serialized tree data was embedded in an inline JavaScript block, allowing injection of malicious HTML/JavaScript. An attacker could perform actions in the victim's session context.
A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.
An integer overflow vulnerability was addressed with improved input validation. The issue affects iOS, iPadOS, macOS, tvOS, and visionOS. A remote attacker may cause unexpected application termination or heap corruption.
An out-of-bounds write issue was addressed with improved input validation. Affects iOS, iPadOS, macOS, tvOS, and visionOS. A remote attacker may cause unexpected application termination or heap corruption.