CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In openssl_encrypt (pip) versions <= 1.4.7, an information exposure vulnerability exists where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr (crypt_cli.py, handle_hsm_command). The printed value can persist in terminal scrollback, session recordings, or CI logs. Impact is limited because the pepper is derived from a random per-invocation test salt and is salt-bound, so the leaked value cannot be used to decrypt real files. Fixed in 1.4.8 (and 1.5.0) by removing the hex dumps and routing plugin debug output through the redaction layer.
Use-after-free vulnerability in the time and time zone module. Successful exploitation may affect availability.
Cross-site scripting vulnerability in Webkul Bagisto up to 2.4.4, in the file /customer/account/rma/send-message of the RMA Message Handler component. Manipulation of the Message argument allows remote script execution in the browser. The exploit has been publicly disclosed.
Vulnerability in DualSafe Password Manager & Digital Vault extension up to 1.4.35 on Chrome, affecting an unknown function of the postMessage-based Bridge component. Manipulation leads to information disclosure. The attack can be launched remotely but is difficult to exploit. The exploit has been published.
A weakness has been identified in Azuriom CMS up to version 1.2.12. This affects the function transferMoney of the file app/Http/Controllers/ProfileController.php of the Money Transfer Handler component. The manipulation causes a time-of-check time-of-use issue. The attack can be initiated remotely but requires high complexity.
A vulnerability was determined in automad up to version 2.0.0-beta.32. This affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the Password Reset Endpoint component. Manipulation of the argument name-or-email causes an observable response discrepancy. The attack can be initiated remotely but is difficult.
A vulnerability was detected in TrailDB 0.6. It affects the tdb_open function in /src/tdb.c of the TOC Validation component. The manipulation results in an out-of-bounds read. The attack can be launched remotely and the exploit is public.
OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation, degrading system performance and preventing timely completion of the init process.
A security flaw was discovered in code-projects Online Shopping System 1.0 in the file /checkout.php. Manipulating the amount_1 argument results in cross site scripting. The attack can be initiated remotely, and the exploit is public.
A vulnerability was detected in the Online Food Order System 1.0 by code-projects. It affects an unknown function in the file edit_food_items.php. Manipulation of the argument dname leads to cross-site scripting. The attack can be performed remotely, and the exploit is publicly available.
A weakness was identified in pkp-lib versions 3.3.0, 3.4.0, and 3.5.0. It affects the setData function in the file classes/user/form/APIProfileForm.php, related to API Key Generation. Manipulation of the apiKey argument leads to insufficient entropy. The attack can be performed remotely but has high complexity and is difficult to exploit. A patch is available with ID 529b5df878e571ccc727647f7748eafc1466b041.
A vulnerability was found in SourceCodester Online Book Store System 1.0. It affects unknown code in the file /admin/index.php?page=site_settings of the System Settings Module. The manipulation leads to cross-site scripting. The attack can be executed remotely, and the exploit is publicly available.
In VictoriaMetrics up to version 1.146.0, a vulnerability was found in the VMAuth Authentication Endpoint component, in the requestHandler function of app/vmauth/main.go. The issue is improper restriction of excessive authentication attempts, allowing brute-force attacks. The attack is remote but requires high complexity. Upgrading to version 1.147.0 is recommended.
In the dtale tool (mangroup) up to version 3.22.0, a vulnerability was found in the Login function in dtale/auth.py. The issue is improper restriction of excessive authentication attempts, allowing brute-force attacks. The attack is remote but has high complexity. The exploit has been published, and the project has not responded.
In the dtale tool (mangroup) up to version 3.22.0, a vulnerability was found in the build_secret_key function in dtale/app.py, related to Flask session cookies. The issue is insufficiently random values, which may allow an attacker to predict the session key. The attack is remote but requires high complexity. The exploit has been published, and a pull request with a fix awaits acceptance.
In the Open Source Point of Sale (opensourcepos) up to version 3.4.2, a vulnerability was found in the Login::index function in app/Config/Filters.php. The issue is improper restriction of excessive authentication attempts, allowing brute-force attacks. The attack is remote but requires high complexity. The exploit has been published, and the project has not responded.
A vulnerability in the D-Link DIR-842 router (version 2.01.B04) affects an unknown function in the /etc/vsftpd.conf file of the vsftpd component. Manipulation leads to incorrect default permissions. The attack can be launched remotely but has a high complexity level and is considered difficult to exploit.
A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. It affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. Manipulation of the argument exchange_mode causes missing encryption of sensitive data. The attack can be initiated remotely, but the complexity is rather high and exploitability is reported as difficult.
OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field.
CWE-327 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Johnson Controls TL280 allows cryptanalytic attack.