CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.25)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in Gitea up to version 1.26.1 allows repository archive downloads to bypass token scope checks on the web archive download endpoint.
A vulnerability in Keras version 3.14.0 allows arbitrary code execution due to improper deserialization handling in the `Lambda` layer. The `_raise_for_lambda_deserialization()` function fails to enforce safe-mode when `safe_mode` is `None` (default), bypassing the guard and allowing attacker-controlled `marshal` bytecode to be deserialized.
In the Net::IP::LPM library for Perl versions up to 1.10, a heap out-of-bounds read vulnerability was found. The add() function does not validate the prefix length against the address width, allowing an overly long prefix (e.g., /255 for IPv4 or IPv6). This causes a read beyond the packed address buffer during trie construction.
A SQL injection vulnerability has been discovered in Destekz by Raera - Ankara Web Design and Digital Advertising Agency, due to improper neutralization of special elements in SQL commands. This flaw allows an attacker to execute arbitrary SQL queries on the database.
An improper restriction of XML external entity reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library) allows XXE attacks. Affects versions from 4.8.0-beta00005 up to 4.8.0-beta00017.
A flaw was found in HPLIP (HP Linux Imaging and Printing Software) due to an incomplete fix for CVE-2026-8631. This vulnerability, caused by an integer overflow in the hpcups processing path, may allow a remote attacker to escalate privileges or achieve arbitrary code execution.
A flaw in libcurl caused the command to clear proxy authentication credentials to be ineffective, leaving old credentials in memory. These credentials were then used in subsequent transfers that should not have access to them.
A vulnerability in the libcurl library causes a leak of the proxy authorization header between requests. When reusing a libcurl handle for sequential transfers with environment-variable proxy configuration, the proxy authentication state is not cleared between requests. As a result, the `Proxy-Authorization:` header intended for one proxy may be sent to another.
A vulnerability in curl causes it to incorrectly use another user's password from the .netrc file when a URL with a username (without password) is provided, potentially leading to credential confusion.
A double-free vulnerability has been found in the curl library's SASL authentication handling. The GSASL context is cleaned up twice without clearing the pointer, causing free() to be called on the same memory region twice.
A flaw in curl's cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.
A vulnerability in libcurl causes the Authorization header intended for the original host to be incorrectly forwarded to a different host when reusing a handle for HTTP transfers with Digest authentication.
A vulnerability in the libcurl library involves the connection pool, which may retain connections using default native CA trust. When an application switches a handle to custom CA material, old connections might still be reused with the original trust settings.
A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, subsequently invokes curl_easy_reset(), and finally terminates the handle with curl_easy_cleanup(). During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.
The Printcart Web to Print Product Designer for WooCommerce plugin up to version 2.5.2 is vulnerable to arbitrary file deletion due to insufficient path validation in the store_design_data() function. The user-supplied 'nbd_item_key' POST parameter is sanitized only with sanitize_text_field(), which does not strip path traversal sequences, and then passed directly to Nbdesigner_IO::delete_folder() and PHP's rename().
Gardyn devices expose a privileged iothubowner key. Access to this key allows an attacker to invoke the IoTHub Registry Manager function, which returns connection information for all Gardyn Home Kit and Studio devices. Additionally, the key enables arbitrary command execution on a specific connected device and may allow pivoting to other devices on the user's network.
A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to escalate privileges over a network.
A Server-Side Request Forgery (SSRF) vulnerability in Azure OpenAI allows an authorized attacker to elevate privileges over a network.
An open redirect vulnerability in M365 Copilot allows an unauthorized attacker to redirect users to a malicious site, potentially leading to privilege escalation over a network.
A vulnerability in fast-mcp-telegram before version 0.19.1 allows a remote HTTP client to bypass authentication by manipulating the Bearer token with path separators. A token like '../fast-mcp-telegram/telegram' grants access to the default legacy session, bypassing the reserved session name control.