CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.19)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series from n/a through 2.17.0.
Vulnerability in linuxfabrik-lib and Linuxfabrik Monitoring Plugins allows reading files via a hidden --test argument that does not confine paths to the test directory. An attacker controlling the nagios or icinga account can disclose root-readable file contents, e.g., via the deb-updates plugin.
Vulnerability in Linuxfabrik Monitoring Plugins allows reading arbitrary files via the logfile plugin, which does not confine the path to /var/log. An attacker controlling the monitoring account can read files such as /etc/shadow.
Cross-site Scripting (XSS) vulnerability in the Draft List plugin (simple-draft-list) allows stored XSS. Versions up to 2.6.4 are affected.
Vulnerability in libheif (up to 1.23.0) allows application crash via a crafted HEIF sequence that does not register sequence tracks, leading to assertion or undefined behavior when calling heif_context_get_track.
Vulnerability in libheif (up to 1.23.0) allows heap corruption via a crafted image sequence with mismatched alpha plane dimensions, leading to out-of-bounds write during encoding.
Vulnerability in libheif (up to 1.23.0) allows crash or corrupt tiling results via a crafted HEIF/AVIF file with a clean aperture box that reduces dimensions to zero, causing underflow and assertion or incorrect results.
Vulnerability in 4gaBoards (before 3.3.9) allows any authenticated user to enumerate accounts and read data of all users via the /api/users API, without authorization.
Vulnerability in Streambert (from 2.5.0 to 2.6.0) allows script injection in the Wyzie key redemption window, which removes the CSP header and lacks window open restrictions, enabling malicious script execution in the application context.
Vulnerability in CefSharp (before 148.0.90) allows reading files outside the configured directory via FolderSchemeHandlerFactory, which uses an incorrect path prefix comparison, enabling access to files in similarly named directories.
Vulnerability in Confidential Containers Guest Components (from 0.16.0 to 0.20.0) allows creating a hardlink outside the destination directory via a crafted OCI image layer, potentially leading to writing data outside the pod VM.
Information leak in Skia in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
Incorrect reference resolution in Core in Google Chrome on Android prior to 151.0.7922.169 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
Inappropriate implementation in CORS in Google Chrome prior to 151.0.7922.169. A remote attacker who compromised the renderer process can bypass site isolation via a crafted HTML page.
Vulnerability in Oracle Fusion Middleware Helidon product (component: Imperative Web Server) version 4.5.3. Easily exploitable flaw allows an unauthenticated attacker with network access via HTTP to cause a partial denial of service (partial DoS) of Helidon.
Vulnerability in Oracle Fusion Middleware Helidon product (component: Imperative Web Server) version 3.2.18. Easily exploitable flaw allows a low-privileged attacker with network access via HTTP to perform unauthorized update, insert or delete access to some Helidon accessible data, as well as unauthorized read access to a subset of data.
Vulnerability in Oracle Fusion Middleware Helidon product (component: Imperative Web Server) version 4.5.0. Easily exploitable flaw allows an unauthenticated attacker with network access via HTTP to perform unauthorized read access to a subset of Helidon accessible data and cause a partial denial of service.
Vulnerability in Oracle Fusion Middleware Helidon product (component: Imperative Web Server) version 4.5.0. Easily exploitable flaw allows a low-privileged attacker with network access via HTTP to perform unauthorized update, insert or delete access to some Helidon accessible data, as well as unauthorized read access to a subset of data.
Vulnerability in Oracle Fusion Middleware Helidon product (component: Imperative Web Server) version 4.5.0. Easily exploitable flaw allows a low-privileged attacker with network access via HTTP to perform unauthorized update, insert or delete access to some Helidon accessible data, as well as unauthorized read access to a subset of data.
Vulnerability in Oracle Fusion Middleware Helidon product (component: Imperative Web Server) version 4.5.1. Easily exploitable flaw allows an unauthenticated attacker with network access via HTTP to perform unauthorized read access to a subset of Helidon accessible data.