CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.20)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
JIT miscompilation in the JavaScript Engine: JIT component. Fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
A spoofing issue exists in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.
Same-origin policy bypass in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Information disclosure in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Vulnerability in the Graphics component causes a site isolation issue. It was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
Vulnerability in the Graphics: WebRender component causes a site isolation issue. It was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
Vulnerability in the Audio/Video: Playback component allows bypassing the same-origin policy. It was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Vulnerability in the Networking: Cookies component allows bypassing the same-origin policy. It was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Clickjacking vulnerability in Firefox for Android. This flaw was fixed in Firefox 154.
When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could later be loaded by the application, resulting in DLL sideloading. The installer has been hardened to detect potentially unsafe installation directories and now requires explicit user confirmation before proceeding with installation in such locations.
The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key, leading to potential loss of data integrity.
A Zabbix administrator can read out-of-bounds memory by exploiting a flaw in the HttpRequest logic of script items/preprocessing (JavaScript), leading to potential confidentiality loss.
An authenticated user can cause disproportionate CPU load on the Frontend webserver by sending specially crafted requests to the validate.api.exists action, leading to potential denial of service.
The frontend validate.api.exists action can be exploited by authenticated users to extract plaintext user macro values, leading to potential loss of confidentiality.
An unauthenticated user can cause disproportionate CPU load on the Frontend webserver by sending specially crafted requests to the popup.testtriggerexpr action, leading to potential denial of service.
The login lockout mechanism in Zabbix API and Frontend has a flaw where several unsuccessful login requests sent simultaneously are not properly counted towards the block counter, potentially allowing more password guesses than intended.
External control of file name or path vulnerability in Citrix WorkSpace App on MacOS. This issue affects WorkSpace App: 2607.
Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows accessing functionality not properly constrained by ACLs. This issue affects EdoWEB before 780-g7.