CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is unused.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is unused.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is unused.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is unused.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is unused.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is unused.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is unused.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is unused.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is unused.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is unused.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is unused.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is unused.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is unused.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is unused.
A path traversal vulnerability was found in boxpositron with-context-mcp up to 3.0.7, affecting functions ingest_notes, teleport_notes, sync_notes, and project_folder in src/index.ts. The attack can be launched remotely. The exploit has been published and may be used. The project was informed but has not responded.
A logic vulnerability (fail-open condition) has been identified in the Metasploit Framework's JSON-RPC web service interface. When an exception occurs during the database health check (db.check) and the environment variable MSF_WS_JSON_RPC_API_TOKEN is not set, the application resets the internal state flag msf.auth_initialized to false. The ApiToken Warden authentication strategy misinterprets this false value as an indicator that authentication is not initialized or required, thereby granting unauthenticated local access to the JSON-RPC request dispatcher.
A path traversal vulnerability was detected in bsmi021 mcp-file-context-server 1.0.0, in the read_context function of src/index.ts (Path Resolution component). Manipulating the path argument allows remote attacks. The exploit is now public and may be used. The project was informed but has not responded.
A path traversal vulnerability was detected in danielpopamd linkedin-ads-mcp 1.0.0, in the fs.readFileSync function of src/tools/campaign-management.ts (Media Upload component). Manipulating the filePath argument allows remote attacks. The exploit has been publicly disclosed and may be used. The project was informed but has not responded.
An out-of-bounds write in the SmiFlash SMM module of ASUS FA507NU and FA507NV BIOS allows a local administrator to cause a system crash (BSOD) or BIOS corruption via a crafted software SMI (SW SMI) request with an oversized length value.
A server-side request forgery (SSRF) vulnerability was discovered in ddfourtwo sentry-selfhosted-mcp 0.4.0, in the raw_sentry_api component. Manipulating the endpoint argument allows remote attacks. The exploit has been released publicly. The project was informed but has not responded.