CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Ubuntu Linux versions 6.8, 6.17, and 7.0 contain SAUCE patches that fail to validate invalid sizes of the name field in AppArmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses.
Ubuntu Linux 6.8, 6.17, and 7.0 contain SAUCE patches that may lead to a NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user, potentially resulting in a kernel oops.
Synapse to otwartoźródłowa implementacja serwera domowego Matrix. Przed wersją 1.152.1, w federacyjnych pokojach, złośliwe serwery domowe mogły tworzyć zdarzenia pokojowe w sposób, który uniemożliwiał Synapse dostarczenie pełnej historii dla klientów paginujących, co mogło prowadzić do braku wyświetlania historii pokoju.
PyJWT to implementacja JSON Web Token w Pythonie. W wersjach przed 2.13.0, metoda PyJWKClient.get_signing_key() wymuszała nowe żądanie HTTP do punktu JWKS dla każdego JWT z nieznaną wartością kid, bez ograniczeń w liczbie żądań.
pypdf to darmowa i otwartoźródłowa biblioteka PDF napisana w czystym Pythonie. Przed wersją 6.12.0, atakujący mógł wykorzystać tę podatność do stworzenia pliku PDF, który prowadził do długich czasów wykonywania.
Serwer Northern.tech Mender w wersjach v4.1.0, v4.0.1 i wcześniejszych jest podatny na atak typu Directory Traversal. Problem został naprawiony w wersjach v4.1.1 i v4.0.2.
Serwer Mender Enterprise firmy Northern.tech w wersjach przed 4.1.1 ma błędną kontrolę dostępu, co może prowadzić do nieautoryzowanego dostępu do zasobów systemowych.
A vulnerability in the Linux kernel related to the inheritance of LOG_SUBDOMAINS_OFF during fork() operations has been resolved. The issue was that the Landlock security blob was not copied when the source credential had no assigned domain, leading to unexpected audit results in child processes.
A vulnerability in Erlang OTP's public_key module (pubkey_ocsp) allows forged OCSP responses signed with an expired responder certificate to be accepted as valid. The validity period of the OCSP responder certificate is not checked.
Vulnerability in QianFox FoxCMS up to version 1.2.6. An unknown function in the file /Tag/edit in the admin panel is vulnerable to XSS. The attack can be performed remotely.
AppLockZ App Lock and Fingerprint Lock version 4.2.11 for Android allows a local attacker with physical access to bypass the PIN lock. The lock is implemented as an overlay rather than using Android's secure authentication APIs. By navigating cascading interfaces and exploiting exposed routes, an attacker can bypass lockscreen verification and access protected apps (e.g., Chrome), leading to information disclosure and privilege escalation.
SailingLab AppLock for Android version 4.3.8 implements the PIN lock as an overlay rather than using Android's secure authentication APIs. A local attacker with physical access can bypass the lock screen by navigating cascading interfaces or using advertisement/browser intents, gaining access to protected apps like Chrome.
Easyelife App lock (Fingerprint,Applock) version 1.9.2 for Android allows a local attacker with physical access to bypass the PIN lock. The lock is implemented as an overlay rather than using Android's secure APIs. The attacker can evade the lockscreen and access protected apps like Chrome.
In GPAC up to version 2.4.0, the function Media_GetSample in file src/isomedia/media.c of the MP4Box component causes a memory leak when manipulating the 'cat' argument. The attack requires local access, and the exploit has been publicly disclosed.
Vulnerability in GPAC up to version 2.4.0 in the MergeFragment function of src/isomedia/isom_intern.c in the MP4Box component causes a null pointer dereference via a local attack. Exploit has been published.
A path traversal vulnerability was found in Magic Wormhole before version 0.24.0 when receiving files with the '--output <dir>' option and the target directory already exists. This allows writing files outside the intended directory.
A cross-site scripting vulnerability was found in the Hospitals Patient Records Management System version 1.0 in the file /admin/?page=patients/view_patient. Manipulation of the Remarks argument allows remote script injection. The exploit is publicly available.
Bugsink before 2.2.0 has a vulnerability where the issue list authorizes access via the project in the URL but applies bulk actions to submitted issue IDs without verifying they belong to that project. Fixed in 2.2.0.
Bugsink before 2.2.0 has a vulnerability where issue event pages accept a direct event identifier from the URL without verifying it belongs to the issue. A user with access to one project can view another project's event data. Fixed in 2.2.0.
This vulnerability stems from a business logic flaw. Attackers can exploit legitimate application functions in unintended and abnormal ways, deviating from the designer's expectations, to carry out malicious attacks.