CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates only the upper bound of its sample index and then subtracts one before indexing the pat_loops array, allowing a read of one byte before the array when the index is zero.
File Browser prior to 2.63.17 directly serializes the Link storage struct in sharePostHandler, shareListHandler, and shareGetsHandler, exposing password_hash and the bypass token in API responses. An administrator can retrieve these secrets for every user's shares, enabling offline password cracking and direct access to protected shares.
MyBB prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator's default user list view by embedding a specially crafted URL. The Set as Default control changes the administrator's default view on GET requests without request forgery protection.
MyBB prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route duplicates archived mailing entries into new drafts on GET requests without request forgery protection.
MyBB prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET requests for the disable and enable actions without verifying the my_post_key token.
Pyenv prior to 2.8.0, is_version_safe() accepts shell glob metacharacters in .python-version values, and unquoted PYENV_VERSION expansion in several scripts pathname-expands the value against the current directory, allowing a matching attacker-controlled file to silently select a different installed interpreter or version.
A vulnerability in the ONNX library from version 1.3.0 to 1.22.0 allows an out-of-bounds read in Gemm_7_6::adapt_gemm_7_6() during opset 7 to 6 downgrade when a Gemm node has input tensors with fewer than two dimensions. This can cause a process crash.
An authenticated administrator can crash Zabbix server or proxy by creating specially crafted preprocessing/script item JavaScript scripts, leading to denial of service.
The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon changing the token endpoint.
A vulnerability in karakeep-app karakeep up to 0.32.0 affects an unknown function in apps/web/server/auth.ts of the OAuth Sign-In component. Manipulation causes improper authentication. The attack can be initiated remotely but is difficult to exploit. The exploit has been publicly disclosed.
A vulnerability was found in karakeep up to 0.32.0 in the authorize function of the auth.ts file in the Login Endpoint component. The manipulation results in improper restriction of excessive authentication attempts. The attack can be performed remotely but is characterized by high complexity and difficult exploitability. The exploit is public.
Mattermost versions 10.11.x <= 10.11.20 and 11.7.x <= 11.7.5 fail to remove thread membership records when a user is removed from or leaves a team, allowing a previously removed user who is later re-invited to view private channel thread root post content and metadata via the team threads API.
Mattermost Desktop App versions <=6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, allowing a local attacker with access to the report or log files to obtain the plaintext pre-auth secret via inspecting the Server Connectivity (Step-3) diagnostics output.
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.
In JetBrains IntelliJ IDEA before 2026.2.1, command execution via crafted Markdown preview content was possible in trusted projects.
Dell ObjectScale versions prior to 4.3.0.1 contain a Path Traversal vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure.
Dell iDRAC9 versions prior to 7.20.30.50 and Dell iDRAC10 versions prior to 1.20.60.50 contain a Remanent Data Readable after Memory Erase vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information disclosure.
In openssl_encrypt versions before 1.4.0, a logging bug in restore_hidden_modules() logs module counts after clearing, always showing zero restored modules and corrupting audit trails. Additionally, a race condition exists between module hiding and import hook installation, which in multi-threaded environments could allow another thread to re-import blocked modules.