CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.19)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in Oracle WebCenter Portal (component: Composer) allows a low-privileged attacker via HTTP to take over the portal. The attack may impact other products (scope change). CVSS score 9.9.
Vulnerability in Oracle WebCenter Portal (component: Portlet Services) allows an unauthenticated attacker via HTTP to gain unauthorized data access and cause hangs or frequent crashes (DoS). CVSS score 9.1.
Vulnerability in Oracle Identity Manager (component: OIM Legacy UI) allows an unauthenticated attacker via HTTP to completely take over the system. CVSS score 9.8.
Vulnerability in Oracle Identity Manager (component: OIM Legacy UI) allows an unauthenticated attacker via HTTP to completely take over the system. CVSS score 9.8.
Vulnerability in Oracle Identity Manager (component: OIM Legacy UI) allows a low-privileged attacker via HTTP to completely take over the system. The attack may impact other products (scope change). CVSS score 9.9.
Vulnerability in Oracle WebLogic Server (component: Core) allows a low-privileged attacker via T3 or IIOP to completely take over the server. The attack may impact other products (scope change). CVSS score 9.9.
Vulnerability in Oracle WebLogic Server (component: Core) allows an unauthenticated attacker via IIOP to completely take over the server. CVSS score 9.8.
Vulnerability in Oracle WebLogic Server (component: Core) allows an unauthenticated attacker via T3 or IIOP to completely take over the server. CVSS score 9.8.
Vulnerability in Oracle WebLogic Server (component: Core) allows an unauthenticated attacker via T3 or IIOP to completely take over the server. CVSS score 9.8.
Vulnerability in Oracle Hospitality Simphony (POS component) allows an unauthenticated attacker via HTTP to compromise the system, leading to unauthorized data modification and complete denial of service. CVSS score is 9.1.
A flaw in TRENDnet TV-IP751WIC (version 11.03.03) affects functions SystemNetworkChanged, SystemDDNSChanged, SystemEmailChanged, SystemFTPChanged, websCheckRealm, FUN_00432574, and FUN_0043372C in the alphapd component. Manipulation leads to stack-based buffer overflow, exploitable remotely.
FUXA version 1.3.2 and earlier has a vulnerability in the allowDashboard authorization gate that allows a remote unauthenticated attacker to obtain a signed guest token and access the Node-RED editor and flow deployment API. The attacker can deploy malicious nodes or execute scripts, gaining control over project data, configuration, and potentially the operating system.
In openHiTLS 0.2.0 through 0.3.2, during X.509 certificate chain verification, the basic constraints extension and CA flag processing of intermediate CAs are only verified for v3 certificates, and v1/v2 certificates are ignored.
ZEBRA, a Zcash node written in Rust, before version 4.5.0 can accept a block that zcashd rejects due to undercounting the P2SH signature-operation counter for scripts containing a disabled opcode. An attacker can exploit this to cause a chain split, affecting network integrity and availability.
Lemur before version 1.9.2 has a vulnerability that allows authenticated users to influence the ACME authority URL (acme_url) without effective server-side destination restriction, enabling SSRF attacks on internal services or cloud metadata. Additionally, there is an authorization weakness that could preserve access to private keys after ownership changes.
NVIDIA Triton Inference Server for Linux contains a vulnerability that allows an attacker to perform path traversal, potentially leading to denial of service.
Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the cache, relying only on CRC32 checksums. Attackers can substitute content, poisoning the cache with malicious container image layers or manifests that are then executed by other hosts.
Context7 through 2.1.2 contains a prompt injection vulnerability that allows attackers to execute malicious instructions in connected AI coding agents by injecting unsanitized content through the Custom AI Instructions feature served via the MCP server. Attackers can exfiltrate credentials from environment files and perform destructive file deletion on the victim's machine.
Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass.
Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass.