CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In the setTo function of ResourceTypes.cpp, there is a possible read out of bounds due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
In handleBondStateChanged of AdapterService.java, there is a possible sensitive information disclosure due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings across users due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
A logic error in KeyguardViewMediator.java allows bypassing lockdown mode via screen pinning. This could lead to local information disclosure without additional privileges or user interaction.
A flaw was found in gnutls where the PKCS#7 padding check during decryption was not constant-time. This timing side-channel could allow a remote attacker to leak sensitive information about padding bytes. This is a form of information disclosure.
Nextcloud is an open source content collaboration platform. From version 6.1.0 to before version 8.2.2, an attacker can craft links that would redirect users to another website, when the victim uses the attackers link to log in via user OIDC. This issue has been patched in version 8.2.2.
In Nextcloud prior to version 2.7.2, authenticated users can check if arbitrary files are associated with specific approval workflows where they can request approval. This issue has been patched in version 2.7.2.
In Capsule for Kubernetes prior to 0.13.0, a vulnerability allowed namespace hijacking via namespace/finalize and namespace/status subresources. The validating webhook does not intercept these subresources, allowing a tenant admin to modify namespace metadata.
In Nextcloud prior to versions 21.1.10, 22.0.11, and 23.0.3, a low-privileged user can force other users' microphones to be muted in calls when no High-performance Backend is installed.
In Nextcloud from versions 1.15.0 to before 1.15.4, 1.16.0 to before 1.16.3, 1.17.0 to before 1.17.1, and 1.18.0 to before 1.18.1, a malicious user with access to an end-to-end encrypted files drop link could drop files into other encrypted folders of the share owner. Reading and modifying other files was not possible.
In Nextcloud Server from versions 32.0.0 to before 32.0.7 and 33.0.0 to before 33.0.1, a missing access check allowed adding unknown circles by their ID to other circles. Due to ID complexity (62^15), exploitation is unlikely but possible if the ID is known, enabling membership tracking.
Nextcloud, an open source content collaboration platform, from version 2.6.0 to before version 4.3.0, allowed guests with view-only access to a collective to access deleted pages from the trashbin if a previous collective page was deleted. This issue has been patched in version 4.3.0.
In janet-lang janet up to version 1.41.0, a vulnerability in the unmarshal_one_fiber function of src/core/marsh.c leads to an integer overflow. The attack requires local access, and the exploit has been publicly released.
A security flaw in janet-lang janet up to version 1.41.0 affects the doframe function in src/core/debug.c, causing an out-of-bounds read. Local access is required, and the exploit is publicly available.
A path traversal vulnerability was found in lharries whatsapp-mcp 0.0.1 in the SendMessageRequest function in whatsapp-bridge/main.go. The attack can be performed remotely and the exploit is public. A patch is available.
A deserialization of untrusted data vulnerability in logback-core's HardenedObjectInputStream module allows an attacker who can influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer to instantiate Proxy objects. Although deserialization is heavily restricted, this constitutes a bypass of intended security restrictions.
A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0, allowing XSS in the create_generic_name function via the generic_name argument. The attack is remotely exploitable and the exploit is public.
A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0, allowing XSS in the create_medicine_presentation function via the medicine_presentation argument. The attack is remotely exploitable and the exploit is public.
The create_supplier function in /ShowForm/create_supplier/main in SourceCodester Pharmacy Sales and Inventory System 1.0 is vulnerable to XSS via manipulation of the company_name argument. The attack can be performed remotely and the exploit is publicly available.
The create_medicine_name function in /ShowForm/create_medicine_name/main in SourceCodester Pharmacy Sales and Inventory System 1.0 is vulnerable to XSS via manipulation of the medicine_name argument. The attack can be performed remotely and the exploit is publicly available.