CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In Sentry, an error tracking and performance monitoring platform, there is a vulnerability that allows an attacker to retrieve a valid access token for another user during the OAuth token exchange. This issue affects versions from 10.0.0 to prior to 23.7.2 due to incorrect credential validation.
The uthenticode library prior to the 2.x series did not check Extended Key Usages (EKU) in certificates, violating the Authenticode X.509 certificate profile. This allows a malicious user to create a 'signed' PE file that uthenticode would mistakenly validate using a certificate that is not entitled to produce code signatures.
A flaw was found in the exFAT driver of the Linux kernel related to the file name reconstruction function. This vulnerability allows a local privileged attacker to overflow the kernel stack, potentially leading to privilege escalation.
A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause memory corruption when an authenticated user opens a tampered log file from GP-Pro EX.
Adobe Dimension version 3.4.9 is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR.
Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Incorrect Authorization vulnerability that could lead to a Security feature bypass. A low-privileged attacker could leverage this vulnerability to access other user's data.
In PHOENIX CONTACT's WP 6xxx series web panels in versions prior to 4.0.10, an authenticated remote attacker with admin privileges can read hardcoded cryptographic keys, allowing them to decrypt an encrypted web application login password.
In PHOENIX CONTACT's WP 6xxx series web panels in versions prior to 4.0.10, a remote attacker with low privileges can gain limited read-access to the device-filesystem through a configuration dialog within the embedded Qt browser.
In PHOENIX CONTACT's WP 6xxx series web panels in versions prior to 4.0.10, a remote attacker with low privileges can gain limited read-access to the device-filesystem within the embedded Qt browser.
The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to and including 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to obtain sensitive information about the site configuration.
CVE-2023-38752 describes an improper authorization vulnerability in the Special Interest Group Network for Analysis and Liaison versions 4.4.0 to 4.7.7, allowing authorized API users to view attribute information of posters marked as 'non-disclosure'.
CVE-2023-38751 describes an improper authorization vulnerability in versions 4.4.0 to 4.7.7 of the Special Interest Group Network for Analysis and Liaison, allowing authorized API users to view organization information set as 'non-disclosure' in the information provision operation.
OpenTelemetry Java Instrumentation prior to version 1.28.0 has an issue related to the instrumentation of Java applications using AWS SDK v2 with Amazon Simple Email Service (SES) v1 API. When instrumenting POST requests to SES, query parameters are inserted into the `url.path` field, leading to the email content being present in telemetry metadata.
The Zoom Client SDK for Windows before version 5.15.0 has cleartext storage of sensitive information, which may allow an authenticated user to enable information disclosure via local access.
Improper input validation in Zoom Desktop Client for Windows before version 5.15.5 may allow an authenticated user to enable information disclosure via network access.
An issue was discovered in Samsung NFC S3NRN4V, S3NSN4V, S3NSEN4, SEN82AB, and S3NRN82 related to buffer copying without checking input size, which can cause an NFC service restart.
Alteryx Server 2022.1.1.42590 does not verify uploaded file types. This flaw allows attackers to upload arbitrary files (e.g., JavaScript for stored XSS) via the 'type' field in a JSON document in a PUT /gallery/api/media request.
The social-media-skeleton project, implemented using PHP, MySQL, CSS, JavaScript, and HTML, has a stored XSS vulnerability in versions 1.0.0 to 1.0.3. The issue is patched in version 1.0.3.
A vulnerability in ASP.NET Core SignalR and Visual Studio allows for information disclosure. An attacker could exploit this flaw to gain access to sensitive data.
Users of jackson-dataformats-text for parsing TOML data may be vulnerable to Denial of Service (DOS) attacks. If the parser is running on user-supplied input, an attacker may provide content that causes the parser to crash due to stack overflow.