CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An integer underflow vulnerability exists in the volxlate function of Netatalk versions 3.0.0 through 4.4.2. It allows a local privileged user to obtain limited information, modify limited data, or cause a minor service disruption via crafted volume translation input.
The Android app RoboForm Password Manager by Siber Systems handles Android intents without proper URL validation, allowing silent file downloads from malicious sites without user consent.
PhoenixStorybook before version 1.1.0 has an authorization bypass vulnerability via a user-controlled key, allowing cross-session PubSub topic injection through a URL parameter. An attacker can hijack communication between LiveView views and iframes.
Missing or insecure X-Content-Type-Options header in HCL BigFix Service Management (SM) allows browsers to perform MIME-type sniffing. This could cause malicious content to be interpreted and executed incorrectly.
Rsync versions before 3.4.3 have an off-by-one stack write vulnerability in establish_proxy_connection(). A network attacker can corrupt stack memory by sending a malformed HTTP proxy response, writing a null byte out of bounds.
A Modification of Assumed-Immutable Data (MAID) vulnerability in Drupal Translate Drupal with GTranslate before version 3.0.5 allows Resource Location Spoofing.
The Node View Permissions plugin for Drupal contains an improper check for unusual or exceptional conditions vulnerability, allowing forceful browsing and unauthorized access to resources. Affected versions are before 1.7.0 and from 2.0.0 before 2.0.1.
In the web management interface of Archer AX72 (SG) v1, the network diagnostic feature improperly handles user input, exposing diagnostic command syntax information.
An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Framework (Unix) allows a local attacker to load a rogue CA certificate as a trusted system authority via a crafted certificate file placed in the application's working directory.
Vulnerability in OpenHarmony version 6.0 and earlier. A local attacker can cause a denial of service (DOS).
Vulnerability in OpenHarmony version 6.0 and earlier allows a local attacker to cause denial of service (DoS).
A local attacker can cause a denial of service (DoS) in OpenHarmony v6.0 and prior versions.
A vulnerability in OpenHarmony v6.0 and prior versions allows a local attacker to cause a denial of service (DoS).
FacturaScripts up to version 2025.7 has a Reflected XSS vulnerability via the fsNick cookie parameter. The cookie value is reflected in HTML without sanitization, allowing script execution before redirect. Fixed in version 2025.8.
Claude HUD through version 0.0.12 contains a path traversal vulnerability that allows attackers to read arbitrary files by supplying an unvalidated transcript_path value via stdin JSON. File metadata is written to a persistent cache file with insufficient permissions, creating a forensic record of accessed paths that survives process exit.
Aplikacje desktopowe Mattermost w wersjach <=6.1, 6.0.1 oraz 5.4.13.0 nie zapobiegają zamykaniu widoku aplikacji przez treści renderowane przez serwer. Umożliwia to złośliwemu serwerowi lub wtyczce zainicjowanie {{window.close()}} w kontekście renderera, co prowadzi do awarii klienta desktopowego.
Wersje Mattermost 11.5.x do 11.5.1 oraz 10.11.x do 10.11.13 nie egzekwują powiązania tożsamości klienta podczas procesu wymiany kodu autoryzacyjnego OAuth. To pozwala uwierzytelnionemu klientowi OAuth na wymianę kodów autoryzacyjnych wydanych dla innego klienta za pomocą spreparowanego żądania wymiany tokenów.
Podatność w SAP NetWeaver Application Server ABAP pozwala atakującemu na wstrzyknięcie niestandardowych arkuszy stylów CSS do strony internetowej serwowanej przez aplikację. W momencie, gdy użytkownik uzyskuje dostęp do dotkniętej strony lub na nią klika, wstrzyknięty CSS jest wykonywany.
W Zoom Workplace dla iOS przed wersją 7.0.0 występuje błąd w mechanizmie ochrony, który może pozwolić uwierzytelnionemu użytkownikowi na ujawnienie informacji poprzez fizyczny dostęp do urządzenia.
A vulnerability in Palo Alto Networks Broker VM allows an authenticated administrator to inject arbitrary content into certain Broker VM fields.