CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In HashiCorp Nomad and Nomad Enterprise versions 0.7.0 to 1.5.6 and 1.4.10, ACL policies using a block without a label generate unexpected results. This issue is fixed in versions 1.6.0, 1.5.7, and 1.4.11.
CVE-2023-3782 affects the OkHttp client, which can experience a denial of service (DoS) when using BrotliInterceptor while visiting a malicious web server or when an attacker can perform a MitM attack to inject a Brotli zip-bomb into an HTTP response.
A vulnerability in aiohttp (up to version 3.8.4) allows HTTP request smuggling attacks due to misinterpretation of HTTP header values. This affects users running aiohttp as an HTTP server.
An arbitrary file upload vulnerability in tduck-platform v4.0 allows attackers to execute arbitrary code via a crafted HTML file.
An infinite loop was discovered in the ngiflib library in the DecodeGifImg function, which may lead to application hang when processing GIF images.
All versions of GE Digital CIMPLICITY that do not adhere to SDG guidance and accept documents from untrusted sources are vulnerable to memory corruption issues due to insufficient input validation. This includes problems such as out-of-bounds reads and writes, use-after-free, stack-based buffer overflows, uninitialized pointers, and heap-based buffer overflow.
The issue is that checking excessively long DH keys or parameters may be very slow. Applications using the functions DH_check(), DH_check_ex(), or EVP_PKEY_param_check() may experience long delays, which could lead to a Denial of Service attack if the keys or parameters are obtained from an untrusted source.
A vulnerability was found in Intergard SGS 8.7.0, leading to cleartext storage of sensitive information in memory. The attack can be initiated remotely.
A vulnerability has been found in Intergard SGS 8.7.0 affecting an unknown functionality of the Change Password Handler component. Manipulation of this vulnerability leads to denial of service, and the attack can be launched remotely.
A critical vulnerability was found in Intergard SGS version 8.7.0, affecting an unknown function. Manipulation of this function leads to permission issues and allows for remote attack.
IBM Robotic Process Automation for Cloud Pak versions 21.0.0 through 21.0.7.4 and 23.0.0 through 23.0.5 is vulnerable to disclosing server version information, which may be used to determine software vulnerabilities at the operating system level.
IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information due to an insecure security configuration in InfoSphere Data Flow Designer.
IBM Spectrum Protect versions 8.1.0.0 through 8.1.17.0 could allow a local user to cause a denial of service due to improper time-of-check to time-of-use functionality.
A critical vulnerability was found in Super Store Finder version 3.6, affecting an unknown functionality of the file /index.php in the POST Parameter Handler component. Manipulation of the 'products' argument leads to SQL injection.
A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted data. When exported to a CSV file, this data may attempt arbitrary command execution on the system used to open the file by spreadsheet software such as Microsoft Excel.
A segmentation violation was discovered in the master branch of ChakraCore cbb9b via the function BackwardPass::IsEmptyLoopAfterMemOp().
A segmentation violation was discovered in the master branch of ChakraCore cbb9b via the function Js::EntryPointInfo::HasInlinees().
A segmentation violation was discovered in the ChakraCore master branch cbb9b via the function Js::ProfilingHelpers::ProfiledNewScArray().
A segmentation violation was discovered in the ChakraCore master branch cbb9b via the function Js::DiagScopeVariablesWalker::GetChildrenCount().
A stack overflow vulnerability was discovered in the ChakraCore master branch cbb9b via the function Js::ScopeSlots::IsDebuggerScopeSlotArray().