CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In hcengineering Huly Platform 0.7.382, the JWT Token Handler component in file foundations/core/packages/token/src/token.ts uses a hard-coded cryptographic key (SERVER_SECRET with value 'secret'). The attack can be initiated remotely but is considered difficult due to high complexity. The vendor did not respond to the disclosure.
In Zcash zcashd before version 6.12.0, invalid transactions could be accepted under certain conditions because Sprout proofs were sometimes not verified. This could lead to draining of user funds from the Sprout pool.
A cross-site scripting vulnerability was found in Akaunting up to version 3.1.21 in the Invoice/Billing component via the notes argument. Remote attack is possible. Exploit is publicly available. The vendor did not respond.
Electron on Windows fails to quote the executable path when writing to the Run registry key, allowing an attacker with write access to an ancestor directory to replace the startup executable.
In Electron before versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, the select-usb-device event callback does not validate the chosen device ID against the filtered list. An app whose handler can be influenced to select a device outside the filtered set may grant access to an unauthorized USB device.
A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based PAM access control rules that rely on fully qualified domain names.
In the Toy Planet Trouble App on Android up to version 1.5.5, a vulnerability was found in the file assets/google-services-desktop.json in the component app.investory.toyfactory. Manipulation of the current_key argument leads to use of a hard-coded cryptographic key. Local access is required.
In Casdoor version 2.356.0, the dangerouslySetInnerHTML function is vulnerable to cross-site scripting via manipulation of the formCss, formCssMobile, or formSideHtml arguments. The attack can be launched remotely, and the exploit has been publicly released. The vendor did not respond.
In the Wahoo Fitness SYSTM app on Android up to version 7.2.1, the file BuildConfig.java uses a hard-coded cryptographic key (SEGMENT_WRITE_KEY). The exploit is publicly available and the vendor has not responded.
In the Individuals & Pro App on Android up to version 2.1.7, a vulnerability was found in the file BuildConfig.java in the component com.afone.noelse. Manipulation of the SEGMENT_WRITE_KEY argument leads to use of a hard-coded cryptographic key. Local access is required.
In the AgentNet Singapore App on Android up to version 23.7.10, a vulnerability was found in the file BuildConfig.java in the component com.allproperty.android.agentnet. Manipulation of the SEGMENT_ANDROID_WRITE_KEY/SEGMENT_TOS_WRITE_KEY arguments leads to use of a hard-coded cryptographic key. Local access is required.
In My Invisalign App 3.12.4 on Android, in the BuildConfig.java file of the com.aligntech.myinvisalign.emea component, manipulation of the CDAACCESS_TOKEN argument leads to use of a hard-coded cryptographic key. Local access required, exploit publicly available. Vendor did not respond.
In Dialogue App up to version 4.3.2 on Android, in the res/raw/config.json file of the ca.diagram.dialogue component, manipulation of the SEGMENT_WRITE_KEY argument leads to use of a hard-coded cryptographic key. Local access required, exploit publicly available. Vendor did not respond.
A vulnerability was found in GRID Organiser App up to 1.0.5 on Android in the file res/raw/app.json. Manipulation of the SegmentWriteKey argument results in use of a hard-coded cryptographic key. The attack requires local access.
A vulnerability was found in Rico só vantagem pra investir App up to 4.58.32.12421 on Android in the file br/com/rico/mobile/di/SegmentSettingsModule.java. Manipulation of the SEGMENT_WRITE_KEY argument leads to use of a hard-coded cryptographic key. The attack requires local environment.
An issue was discovered in Roundcube Webmail before versions 1.5.14 and 1.6.14 where unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.
A vulnerability was found in UCC CampusConnect App up to 14.3.5 on Android in the file campusconnect/BuildConfig.java. Manipulation leads to use of a hard-coded cryptographic key. The attack requires local execution.
Roundcube Webmail before versions 1.5.14 and 1.6.14 has an unsafe deserialization vulnerability in the redis/memcache session handler, which can lead to arbitrary file write operations by unauthenticated attackers.
In Shinrays Games Goods Triple App up to version 1.200, the file jRwTX.java uses a hard-coded cryptographic key (AES_IV/AES_PASSWORD). Local attack with high complexity, exploit published. Vendor did not respond.
In Ella Core prior to version 1.8.0, the PUT /api/v1/subscriber/{imsi} API does not verify that the IMSI from the URL path matches the IMSI from the JSON request body. An authenticated NetworkManager can modify any subscriber's policy while the audit trail records a fabricated IMSI. This is fixed in version 1.8.0.