CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A Use-After-Free vulnerability was found in the Bluetooth component of Google Chrome on Mac prior to version 148.0.7778.216. An attacker who convinced a user to install a malicious extension could potentially perform a sandbox escape via a crafted Chrome Extension.
A use-after-free vulnerability in WebGL in Google Chrome on Android prior to 148.0.7778.216 allows a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
An out-of-bounds read vulnerability in WebGL in Google Chrome on Android prior to version 148.0.7778.216 could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
A use-after-free vulnerability in Dawn in Google Chrome prior to 148.0.7778.216 allows a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
A vulnerability in the GPU component of Google Chrome on Android prior to 148.0.7778.216 allows a remote attacker to potentially escape the sandbox via a crafted HTML page. The issue is an out-of-bounds write.
The Advanced Custom Fields: Extended plugin for WordPress up to version 0.9.2.5 is vulnerable to privilege escalation via validation bypass. The after_validate_save_post() function unconditionally trusts the attacker-controlled _acf_post_id parameter, allowing validation errors to be suppressed and an administrator account to be created.
Portainer Community Edition from version 2.33.0 to 2.33.8, 2.39.2, and 2.41.0 contains a vulnerability where, during creation or update of Git-backed stacks, go-git v5 creates OS symlinks on the host filesystem without validation, except for .gitmodules. An authenticated user with rights to manage Git stacks can include a docker-compose.yml file as a symlink to an arbitrary path, causing the GET /api/stacks/{id}/file endpoint to read and return the symlink target's contents in the HTTP response.
The vulnerability allows authenticated users to create and execute arbitrary JavaScript code on the server. Scripts run with full privileges, enabling complete system compromise as commands are executed as root.
Critical vulnerability in Oracle REST Data Services (Backend-as-a-Service component) affecting versions 24.2.0-26.1.0. An unauthenticated attacker with network access via HTTPS can compromise the service, potentially impacting other products (scope change).
A critical vulnerability in Oracle REST Data Services (versions 24.2.0-26.1.0) allows a low-privileged attacker with network access via HTTPS to take over the service. The attack may impact additional products (scope change).
Vulnerability in the Net Service component of Oracle Database Server versions 23.4.0-23.26.2. Difficult to exploit, allows unauthenticated attacker with network access via TLS to compromise Net Service. Attacks may impact additional products (scope change).
Vulnerability in Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration) in versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can easily exploit this flaw, leading to takeover of Oracle Universal Work Queue and potentially impacting additional products (scope change).
Critical vulnerability in Oracle iAssets (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can take over the system, potentially affecting other products.
A vulnerability in the Oracle Internet Procurement Connector product of Oracle E-Business Suite (component: Internal Operations) allows an unauthenticated attacker to compromise data confidentiality and integrity via HTTP network access. Successful exploitation can lead to unauthorized access, creation, deletion, or modification of critical data.
Critical vulnerability in Oracle Payments (Oracle E-Business Suite) versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP can fully compromise the system without any privileges.
A critical vulnerability in Oracle REST Data Services (versions 24.2.0-26.1.0) allows a low-privileged attacker with network access via HTTPS to take over the service. The attack may impact additional products (scope change).
A SQL injection vulnerability was found in the Marten library for .NET in its full-text search APIs. The user-supplied regConfig parameter was directly interpolated into the generated SQL without parameterization or validation.
Podatność w produkcie Oracle Hospitality OPERA 5 Property Services umożliwia nieautoryzowanemu atakującemu z dostępem do sieci przez HTTP przejęcie kontroli nad tym systemem. Dotknięte wersje to 5.6.19.24, 5.6.22, 5.6.25.19, 5.6.27.6 oraz 5.6.28.
RustFS to rozproszony system przechowywania obiektów zbudowany w języku Rust. Przed wersją 1.0.0-beta.2, warstwa RPC między węzłami autoryzowała każde żądanie za pomocą podpisu HMAC-SHA256, używając wspólnego sekretu, który w przypadku braku konfiguracji domyślnie przyjmował wartość 'rustfsadmin'.
Electerm to otwartoźródłowy klient terminala/ssh/sftp/telnet/port szeregowy/RDP/VNC/Spice/ftp. W wersjach przed 3.9.5, deterministyczne AES-192-CBC z ustalonym zerowym wektorem inicjalizacyjnym, stałą solą KDF i brakiem MAC prowadzi do naruszeń poufności i integralności danych zakładek/profili.