CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.20)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The RSA-OAEP implementation in the Hisilicon HPRE crypto driver in OP-TEE is vulnerable to a padding oracle attack. Non-constant-time memcmp() for label hash verification and distinguishable error paths allow plaintext recovery with approximately 1000-2000 adaptive chosen ciphertext queries.
In OP-TEE from version 3.10.0 to 4.10.0, an unbounded recursion vulnerability in the PKCS#11 TA can cause a system crash. The issue is fixed in version 4.11.0.
A URL path injection vulnerability in the Microsoft Graph adapter of Swoosh allows an attacker to manipulate the request URL by injecting special characters into the sender's email address, potentially redirecting authenticated requests to other Graph endpoints.
A vulnerability was found in GPAC up to b40ce70f5 in the function sgpd_del_entry of the file src/isomedia/box_code_base.c of the MP4Box component. Manipulation of the data argument leads to a heap-based buffer overflow. Local access is required and the exploit is publicly available.
A vulnerability was found in GPAC up to version 2.5-DEV in the function gf_isom_nalu_sample_rewrite of the file src/isomedia/avc_ext.c in the MP4Box component. Manipulation of the nalu_out_bs argument causes a double free. The attack can be performed locally and the exploit has been publicly disclosed.
A vulnerability in Apache Camel Mail component allows an attacker to inject headers from the mail.smtp.* or mail.smtps.* namespace, potentially redirecting the SMTP connection to an attacker-controlled server (pre-4.19.0) or weakening transport security (newer versions). The issue stems from missing HeaderFilterStrategy filtering and the producer interpreting these headers.
A security vulnerability was detected in GPAC 26.03-DEV-rev342-g80071f700-master in the function txtin_probe_duration of the file src/filters/load_text.c of the TeXML File Handler component. Manipulation of the argument txml_timescale leads to a divide by zero. The attack requires local access.
A cross-site scripting vulnerability has been found in Crater Invoice Inc up to version 6.0.6 in the getFormattedString function of app/Http/Requests/InvoicesRequest.php. Manipulating the notes argument in the Invoice Note Handler component can lead to script execution in the browser. The attack is remotely exploitable and the exploit is public.
A flaw in GPAC 26.02.0 affects the nhmldump_send_frame function in src/filters/write_nhml.c of the Media File Handler component, leading to a null pointer dereference. The attack requires local access and an exploit has been published.
A vulnerability was found in radare2 up to version 6.1.6 in the Memory64ListStream parser within mdmp.c. A local attacker can trigger a stack-based buffer overflow by manipulating input data. The exploit is publicly available.
A use-after-free vulnerability has been detected in radare2 up to version 6.1.6 in the function r_core_bin_load within libr/core/cfile.c. The attack requires local access and the exploit has been publicly disclosed.
A vulnerability has been found in radareorg radare2 up to version 6.1.6, involving an integer overflow in the cmd_print function within the pb Print Command Handler component. The attack requires local access and a public exploit is available.
A security flaw in radare2 up to version 6.1.6 affects the r_str_word_get0set function in libr/util/str.c, causing an integer overflow. The attack requires local access and a public exploit is available.
In Zephyr OS, a vulnerability in the DNS resolver uses memcmp() to always compare 7 bytes with the ".local" suffix, even when the final hostname label is shorter. This causes an out-of-bounds read past the string terminator, potentially leading to a page fault and denial of service (DoS). The flaw is present only when CONFIG_MDNS_RESOLVER is enabled and exists since v1.10.0.
A security vulnerability has been detected in radareorg radare2 up to version 6.1.6, involving an integer overflow in the r_str_ndup/r_str_append functions in libr/util/str.c. The attack requires local access and the exploit has been publicly disclosed.
A use-after-free vulnerability has been found in radare2 up to version 6.1.6 in the function r_core_seek_arch_bits within libr/core/disasm.c, specifically in the regprofile handler component.
A heap-based buffer overflow vulnerability was discovered in radare2 up to version 6.1.6 in the r_bin_java_inner_classes_attr_calc_size function of shlr/java/class.c, part of the RBinJava Line Number Table Parser. Local manipulation triggers the overflow, and a public exploit exists.
A vulnerability was found in radare2 up to version 6.1.6 in the cmd_anal_opcode function of libr/core/cmd_anal.inc.c within the hexpairs Parser component. Data manipulation leads to an integer overflow. The attack requires local access and the exploit is publicly available.
A vulnerability in Pardus Pen (TUBITAK BILGEM) involves improper null termination, potentially leading to buffer overflow. It affects versions <=4.1.5 before 4.2.1.
A security vulnerability has been detected in mjperpinosa stumasy up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be. The function add_definition in application/PHP/objects/notes/add_into_dictionary.php is affected by cross-site scripting via the reference argument. The exploit is publicly available and can be used remotely.