CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
OpenZeppelin Confidential Contracts before version 0.3.1 has a vulnerability in the ERC7984 contract where the _mint operation can silently fail due to overflow, and the wrap and onTransferReceived functions do not handle this failure. A user can transfer the underlying token without receiving the corresponding confidential wrapped token, leading to loss of funds after approximately 18.4 trillion tokens with the default rate().
@hono/node-server from version 2.0.0 to 2.0.10 has a vulnerability in WebSocket handling where an upgrade request with a missing or malformed Sec-WebSocket-Key header causes the request to remain in waiterMap with no cleanup path after the handshake is aborted. This allows an unauthenticated attacker to flood a public route, causing unbounded memory growth and service unavailability.
Backstage before version 0.29.2 has a vulnerability in the experimental dynamic client registration and client ID metadata document features in @backstage/plugin-auth-backend. Full-string glob matching can be bypassed, allowing an attacker-controlled redirect URI with a trusted hostname suffix in its path to pass the allowlist and receive an OAuth authorization code after a victim completes the flow. These features are experimental and disabled by default.
Mongoose before versions 6.13.10, 7.8.10, 8.24.1, and 9.7.2 has a prototype pollution vulnerability when passing a user-controlled update with a __proto__.x dotted path under $set. The casting process can set properties on Object.prototype, affecting application integrity and availability.
CyberPanel before version 3.0.0 has a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attackers can access credential files, SSL/SSH private keys, and JWT secret files.
The 'podman quadlet install --replace' command opens the existing Quadlet file without O_TRUNC, which on filesystems without reflink support (e.g., default XFS on RHEL) leads to incomplete overwriting. If the new Quadlet is shorter than the original, old data remains at the end of the file, and the command completes without warning.
A vulnerability in the parse_read_std_char_desc() function in the Bluetooth host subsystem (subsys/bluetooth/host/gatt.c) allows a remote, unauthenticated device to hang the Bluetooth processing thread by sending an ATT response with a zero entry length (rsp->len = 0). The parsing loop does not validate the minimum value of rsp->len, leading to an infinite loop (CWE-835) and failure to terminate descriptor discovery.
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads.
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private.
Private Repository Existence Disclosure via go-get Meta Endpoint.
Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents.
Repository migration SSRF via multi-answer DNS allow-list bypass.
SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL.
Webhooks created by a collaborator keep firing after their repo access is revoked, enabling ongoing real-time exfiltration of private repo content. The issue stems from incomplete revocation cleanup in `DeleteCollaboration`.
A vulnerability in Gitea LFS allows privilege escalation via deploy keys. A person with a deploy key can gain higher privileges than intended.
In code.gitea.io/gitea, there is missing authorization and authorization bypass through user-controlled key, incorrect permission assignment for critical resources, and exposure of sensitive information to an unauthorized actor.
The public-only API token restriction is not enforced on team API routes. This means a token intended for public access only can access team data that should be private.
The vulnerability allows bypassing the public-only scope of personal access tokens in organization and permission endpoints. This means a token intended only for public operations can access operations requiring broader privileges.
The vulnerability allows bypassing the release attachment extension allowlist via the web release edit form. This is a variant of CVE-2025-68939.
The vulnerability in OAuth token introspection returns metadata of tokens issued to other clients, violating section 4 of RFC 7662.