CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in the RDBMS component of Oracle Database Server allows a low-privileged attacker (Authenticated User) with network access via Oracle Net to compromise the database. No user interaction is required.
Vulnerability in Oracle Hospitality Simphony (POS component) allows an unauthenticated attacker via HTTP to access all system data. Exploitation is easy.
Vulnerability in Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: POS). Affected versions are 19.8-19.8.5, 19.9-19.9.3 and 19.10. A difficult to exploit vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony, potentially leading to a takeover.
Vulnerability in Oracle Hospitality Simphony (POS component) allows an unauthenticated attacker to access critical data via HTTP. The attack does not affect other products.
Vulnerability in MySQL Server and MySQL Cluster (component: Server: Group Replication Plugin) allows an unauthenticated attacker with local access to take over the system. Affects multiple versions of MySQL Server and MySQL Cluster.
Vulnerability in Oracle VM VirtualBox (component: Core). A high-privileged attacker with local access can take over VirtualBox, and the attack may affect other products. CVSS 7.5.
Vulnerability in Oracle GoldenGate (component: Service Manager) allows a low-privileged attacker with network access via HTTP to compromise the system. No user interaction is required.
Vulnerability in Oracle VM VirtualBox (component: Core). A high-privileged attacker with local access can take over VirtualBox, and the attack may affect other products. CVSS 7.5.
A vulnerability in Oracle WebLogic Server (Oracle Fusion Middleware, component: Console) versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. An easily exploitable flaw allows a high-privileged attacker with network access via HTTPS to take over Oracle WebLogic Server. CVSS 7.2.
Vulnerability in Oracle VM VirtualBox 7.2.12 allows a low-privileged local attacker to take over the virtual machine. The attack is easy to exploit and only requires logon to the system where VirtualBox runs.
Vulnerability in Oracle Workflow (component: Workflow Notification Mailer) versions 12.2.3-12.2.15. An easily exploitable flaw allows an unauthenticated attacker with network access via HTTP to modify, read, and partially block data.
In Netty prior to 4.2.16.Final, Http3FrameCodec buffers incoming data for HTTP/3 reserved frame types without limits, trusting the payLoadLength field, allowing an attacker to open multiple QUIC streams and send frames with large payloads, causing memory exhaustion and denial of service.
In Netty up to versions 4.1.135 and 4.2.15, a vulnerability exists in the SpdyHttpDecoder handler. Improper release of a pooled ByteBuf leads to native memory exhaustion.
Netty, a network application framework, contains a vulnerability in the codec-haproxy module in the HAProxyMessageDecoder class. When reading the 13th byte as a signed byte and widening it to int without masking, the value 0xFF is interpreted as -1, causing a collision with the need-more-data sentinel. This leads to unbounded accumulation of data in the cumulation buffer until direct memory is exhausted.
Two bugs in libheif prior to version 1.22.0 chain to leak process heap memory as visible pixel values in decoded grid images. An attacker uploading a crafted AVIF/HEIC file to a server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data, including library function pointers sufficient to defeat ASLR, from publicly downloadable transcoded JPEG/PNG/WebP output.
Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component: Libraries). An unauthenticated attacker via network can compromise data integrity, gaining unauthorized access to create, delete, or modify critical data.
Vulnerability in Oracle Java SE (component: Scripting). Affected versions are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. A difficult to exploit vulnerability allows an unauthenticated attacker with network access via multiple protocols to gain unauthorized access to critical data and modify it.
Vulnerability in the Scripting component of Oracle Java SE allows an unauthenticated attacker to remotely cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. The attack is easily exploitable over network via multiple protocols.
Vulnerability in Oracle VM VirtualBox version 7.2.12, component Core. A low-privileged attacker with local access can easily take over VirtualBox. Affects Windows hosts only.
Vulnerability in Oracle VM VirtualBox version 7.2.8. A high-privileged attacker with local access, requiring user interaction, can modify critical data and cause a complete denial of service (DOS) via hangs or frequent crashes. The attack may impact other products.