CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures are silently ignored. This issue also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 2.0.13.
In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content is not bound to MAC when authAttrs are present. This issue also affects Bouncy Castle for Java LTS before 2.73.12 and BC-FJA before specific versions.
In Bouncy Castle for Java before 1.85, the CMS verifySignatures method returns true for SignedData with zero signers. This issue also affects LTS before 2.73.12 and BC-FJA before specific versions.
In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honor an unbounded KDF cost from input. This also affects LTS before 2.73.12 and FIPS versions before specific bcpkix-fips releases.
In Bouncy Castle for Java before 1.85, the BKS/UBER keystore allocates memory from untrusted lengths before integrity check. This issue also affects LTS before 2.73.12.
A deserialization vulnerability in PRISMAproduction version 6.5 or earlier that may lead to arbitrary code execution.
An incomplete patch for CVE-2026-18556 allows authentication bypass and account takeover in N-central versions up to 2026.3.1.
In the OCPP 1.6 client in Zephyr RTOS, a vulnerability was found involving out-of-bounds buffer read during WAMP RPC frame parsing. The extract_string_field() function uses strncpy without guaranteed null-termination, leading to reads beyond the 128-byte buffer and potential out-of-bounds null write. The vulnerability can be remotely exploited by a malicious central server or an on-path attacker.
Hugging Face Transformers up to version 5.8.0.dev0 has an arbitrary file write vulnerability via path traversal in save_pretrained(). Keys from chat_template are used as filenames without validation.
Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. A link-share JWT with a matching ID can be used to manage another user's tokens.
FreeRDP before 3.29.0 has integer overflows in the audin channel across ALSA, sndio, WinMM, and OpenSL ES backends. A malicious server can supply a FramesPerPacket value causing allocation size wraparound.
ArcadeDB before 26.7.3 fails to bind the authenticated principal in MCP HTTP transport, causing all engine permission checks to be bypassed. MCP users can perform arbitrary writes, DDL, schema mutations, and JavaScript code execution.
ArcadeDB before 26.7.3 leaks the cluster token (arcadedb.ha.clusterToken) in cleartext via the MCP get_server_settings tool. Attackers with MCP access can use it to impersonate root.
ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity().createUser() without permission checks.
better-auth passkey before version 1.4.0 has an insecure direct object reference vulnerability in the passkey deletion endpoint. Authenticated users can delete arbitrary passkeys of other users.
Better Auth relies on the rou3 router library, which normalizes URL paths by removing empty segments. In Better Auth versions prior to 1.4.5, an attacker can bypass disabledPaths configuration and path-based rate limits by submitting requests with extra slashes in the URL path. The issue does not apply when the proxy or platform normalizes URLs by collapsing multiple slashes.
The Simply Schedule Appointments WordPress plugin before version 1.6.12.6 does not restrict a bulk appointment operation to the requester's own records. Unauthenticated users can retrieve personal data of all appointments and, on premium editions, permanently delete them.
The Product Attachment for WooCommerce WordPress plugin before version 2.3.3 does not perform any authorization check before streaming media library files. This allows unauthenticated users to download any attachment, including private or unlinked uploads, by enumerating its numeric ID.
The login-social WordPress plugin through version 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, and it issues authentication sessions from unverified third-party sign-in data. This allows unauthenticated attackers to reset any user's password or log in as any existing account, including administrators, and take over the site.
The AI ChatBot for WooCommerce WordPress plugin before version 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions. This allows unauthenticated users to abuse the site owner's stored third-party API key, send requests billed to the owner's account, and, when an optional feature is enabled, retrieve indexed knowledge-base content.