CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.19)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in Streambert (from 2.5.0 to 2.6.0) allows script injection in the Wyzie key redemption window, which removes the CSP header and lacks window open restrictions, enabling malicious script execution in the application context.
Vulnerability in CefSharp (before 148.0.90) allows reading files outside the configured directory via FolderSchemeHandlerFactory, which uses an incorrect path prefix comparison, enabling access to files in similarly named directories.
Vulnerability in Confidential Containers Guest Components (from 0.16.0 to 0.20.0) allows creating a hardlink outside the destination directory via a crafted OCI image layer, potentially leading to writing data outside the pod VM.
Information leak in Skia in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
Incorrect reference resolution in Core in Google Chrome on Android prior to 151.0.7922.169 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
Inappropriate implementation in CORS in Google Chrome prior to 151.0.7922.169. A remote attacker who compromised the renderer process can bypass site isolation via a crafted HTML page.
Vulnerability in Oracle Fusion Middleware Helidon product (component: Imperative Web Server) version 4.5.3. Easily exploitable flaw allows an unauthenticated attacker with network access via HTTP to cause a partial denial of service (partial DoS) of Helidon.
Vulnerability in Oracle Fusion Middleware Helidon product (component: Imperative Web Server) version 3.2.18. Easily exploitable flaw allows a low-privileged attacker with network access via HTTP to perform unauthorized update, insert or delete access to some Helidon accessible data, as well as unauthorized read access to a subset of data.
Vulnerability in Oracle Fusion Middleware Helidon product (component: Imperative Web Server) version 4.5.0. Easily exploitable flaw allows an unauthenticated attacker with network access via HTTP to perform unauthorized read access to a subset of Helidon accessible data and cause a partial denial of service.
Vulnerability in Oracle Fusion Middleware Helidon product (component: Imperative Web Server) version 4.5.0. Easily exploitable flaw allows a low-privileged attacker with network access via HTTP to perform unauthorized update, insert or delete access to some Helidon accessible data, as well as unauthorized read access to a subset of data.
Vulnerability in Oracle Fusion Middleware Helidon product (component: Imperative Web Server) version 4.5.0. Easily exploitable flaw allows a low-privileged attacker with network access via HTTP to perform unauthorized update, insert or delete access to some Helidon accessible data, as well as unauthorized read access to a subset of data.
Vulnerability in Oracle Fusion Middleware Helidon product (component: Imperative Web Server) version 4.5.1. Easily exploitable flaw allows an unauthenticated attacker with network access via HTTP to perform unauthorized read access to a subset of Helidon accessible data.
Vulnerability in Oracle Fusion Middleware Helidon product (component: Imperative Web Server) version 3.2.19. Difficult to exploit flaw allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data or complete access to all Helidon accessible data.
Vulnerability in Oracle Fusion Middleware Helidon product (component: Imperative Web Server) version 4.5.0. Easily exploitable flaw allows an unauthenticated attacker with network access via HTTP to perform unauthorized read access to a subset of Helidon accessible data.
Vulnerability in Oracle Fusion Middleware Helidon product (component: Imperative Web Server) version 4.5.1. Easily exploitable flaw allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert or delete access to some Helidon accessible data, as well as unauthorized read access to a subset of data.
Vulnerability in Oracle Fusion Middleware Helidon product (component: Imperative Web Server) version 4.5.1. Difficult to exploit flaw allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert or delete access to some Helidon accessible data, as well as unauthorized read access to a subset of data.
Vulnerability in Oracle Fusion Middleware Helidon product (component: Imperative Web Server) version 4.5.1. Easily exploitable flaw allows unauthenticated attacker with network access via HTTP to gain unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impact).
Vulnerability in Oracle Fusion Middleware Helidon product (component: Imperative Web Server) version 3.2.19. Easily exploitable flaw allows unauthenticated attacker with network access via HTTP to gain unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impact).
Vulnerability in Oracle Fusion Middleware Helidon product (component: Imperative Web Server) version 4.5.0. Easily exploitable flaw allows unauthenticated attacker with network access via HTTP to perform unauthorized update, insert or delete access to some Helidon accessible data as well as unauthorized read access to a subset. Attack requires user interaction and may impact additional products (scope change). CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).
Vulnerability in Oracle Fusion Middleware Helidon product (component: Imperative Web Server) version 4.5.0. Easily exploitable flaw allows unauthenticated attacker with network access via HTTP to perform unauthorized update, insert or delete access to some Helidon accessible data as well as unauthorized read access to a subset. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).