CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.20)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
The vulnerability in HCL iControl is due to inadequate session timeout. The web application does not automatically terminate user sessions after a period of inactivity.
A vulnerability in the Oracle VM VirtualBox product (component: VMSVGA device) allows an easily exploitable attack by a high privileged attacker with access to the infrastructure where Oracle VM VirtualBox runs. Attacks may significantly impact additional products, leading to unauthorized access to data.
Vulnerability in the Oracle VM VirtualBox product (component: Core) in version 7.2.8. Easily exploitable by a high privileged attacker with access to the infrastructure where Oracle VM VirtualBox runs, potentially compromising the software.
A vulnerability in the Oracle VM VirtualBox product (component: VMSVGA device) allows a high privileged attacker with access to the infrastructure where Oracle VM VirtualBox runs to compromise the software. Attacks may significantly impact additional products, leading to unauthorized access to data.
A vulnerability in the Oracle VM VirtualBox product (component: VMSVGA device) allows an easily exploitable attack by a high privileged attacker with access to the infrastructure where Oracle VM VirtualBox runs. Attacks may significantly impact additional products.
In the Camera application, there is a possible unauthorized way to access photos due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
In keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed.
In the function iavb_parse_key_data of avb_rsa.c, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed.
In the PostWipeData function of recovery_ui.cpp, there is a possible data persistence issue after a factory reset due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed.
In RtcpChunk::decodeRtcpChunk, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed.
In RtcpByePacket::decodeByePacket, there is a possible vulnerability due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed.
In Zephyr's IPv4 IGMP implementation, a use-after-free vulnerability exists in igmp_send() which reads the network interface pointer after the packet has been sent. This affects versions from v2.6.0 through v4.4.0.
OliveTin versions 3000.0.0 and prior allow access to predefined shell commands from a web interface. The ValidateArgumentType RPC endpoint does not perform any authentication or authorization checks, allowing unauthenticated users to enumerate valid action binding IDs and their argument configurations.
A path traversal vulnerability has been found in the web interface of Intelbras iNVU 7016 FT version 3.004.00IB000.0.T Build 2025-09-26, in the file /RPC2_Loadfile/syslog/. The attack can be launched remotely and an exploit has been published.
Vulnerability in Intelliants Subrion CMS up to version 4.0.3. An unknown functionality of the Blocks Endpoint component allows XSS via manipulation of the CSS class name argument. The attack can be performed remotely.
Vulnerability in the Store Locator WordPress plugin (before version 1.6.9) allows high-privileged users (e.g., administrators) to read arbitrary .php files on the server, including configuration files containing database credentials and authentication keys.
The Store Locator WordPress plugin before 1.6.9 does not sanitize store logo metadata before storing and displaying it on the admin page, allowing high-privileged users (e.g., administrators) to perform Stored XSS attacks even when `unfiltered_html` is disallowed (e.g., in a multisite network).
OpenClaw before version 2026.5.6 has an improper access control vulnerability in Mattermost event handlers that fails to validate channel type metadata. Attackers can bypass DM policy by sending crafted events missing channel type information to process restricted content.
ApostropheCMS is a Node.js content management system that has a vulnerability related to `prettyUrls` in versions up to 4.30.0. When this option is enabled, an attacker can exploit the `Host` header to send HTTP requests to any host on the private network.