CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.19)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unbound DNS server versions 1.16.2 through 1.25.1 are vulnerable to a 'ghost domain names' attack, allowing an adversary controlling a ghost zone to extend the ghost domain window by one configured TTL for A/AAAA glue records. With 'harden-referral-path: yes', no client query is needed.
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly, inflating the number of waiting replies for in-flight queries and causing degradation of resolution service for new clients.
The Ansible Lightspeed extension for Visual Studio Code stores the Google Gemini API key in plain text in the user's configuration file and writes it to log files. A local attacker or malware with user privileges can read this key.
Signed integer overflow vulnerability in libarchive's ZIP writer in archive_write_zip_header. When ZIP encryption is enabled and file size is near INT64_MAX, adding encryption overhead overflows int64_t, causing undefined behavior, potentially incorrect Zip64 decisions or memory corruption.
Google Chrome prior to version 150.0.7871.182 has an uninitialized use vulnerability in Skia. A remote attacker who compromised the renderer process can leak cross-origin data via a crafted HTML page.
Vulnerability in Oracle Time and Labor (component: Internal Operations) versions 12.2.3-12.2.15. Difficult to exploit, requires low privileges and network access via HTTP. Successful attack may cause partial denial of service.
Vulnerability in Oracle EDI Gateway (component: Internal Operations) versions 12.2.3-12.2.15. Difficult to exploit, requires high-privileged attacker with local logon, allows unauthorized read access to a subset of data.
Vulnerability in Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll) in versions 12.2.3-12.2.15. A difficult-to-exploit vulnerability allows a high-privileged attacker with network access via HTTP to gain unauthorized read access to a subset of Oracle HRMS (UK) data. CVSS 3.1 Base Score 2.2 (Confidentiality impact).
Vulnerability in Oracle Agile Engineering Data Management (version 6.2.1) allows a low-privileged attacker with user interaction to cause a partial denial of service.
Vulnerability in Oracle PeopleSoft Enterprise CS Student Records (Research Tracking component) version 9.2.38. Difficult to exploit, allows unauthenticated attacker to gain unauthorized read access to a subset of data.
Vulnerability in MySQL Server and MySQL Cluster (component: Server: Pluggable Auth) in specified versions. Difficult to exploit, unauthenticated attacker with local logon can modify data.
A vulnerability in MySQL Server and MySQL Cluster (Performance Schema component) allows an authenticated attacker with high privileges to unauthorizedly read a subset of data. The attack requires network access and is easy to exploit.
In Oracle PeopleSoft Enterprise FIN Engineering Argentina (version 9.1), a vulnerability in the Engineering component allows a high-privileged attacker with network access via HTTP to gain unauthorized read and update access to some data.
Vulnerability in Oracle Inventory Optimization (Oracle E-Business Suite) versions 12.2.3-12.2.15. A difficult-to-exploit flaw allows a low-privileged attacker with network access via HTTP to cause a partial denial of service (partial DOS).
Vulnerability in Oracle Production Scheduling (versions 12.2.3-12.2.15) allows a high-privileged attacker with local logon to modify data.
Vulnerability in Oracle HRMS (Norway) versions 12.2.3-12.2.15. Easily exploitable by an authenticated attacker with high privileges, allowing unauthorized update, insert, delete, and read access to payroll data.
Vulnerability in Oracle Inventory Management (versions 12.2.3-12.2.15) allows a high-privileged attacker with local logon to cause a partial denial of service.
Vulnerability in Oracle Time and Labor (versions 12.2.3-12.2.15). Difficult to exploit, allows unauthenticated attacker to gain unauthorized read access to a subset of data.
Vulnerability in Oracle HRMS (Ireland) product of Oracle E-Business Suite (component: Internal Operations) in versions 12.2.3-12.2.15. A difficult-to-exploit vulnerability allows a high-privileged attacker with network access via HTTP to gain unauthorized read access to a subset of Oracle HRMS (Ireland) data. CVSS 3.1 Base Score 2.2 (Confidentiality impact).
A vulnerability in Oracle Project Contracts (part of Oracle E-Business Suite) allows a low-privileged attacker via HTTP to unauthorizedly read a subset of data. The attack is difficult to exploit.