CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.15)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in Oracle Application Object Library (versions 12.2.3-12.2.15) in the Core component. A low-privileged attacker via HTTP can gain unauthorized read and modify access to data.
Vulnerability in PeopleSoft Enterprise PeopleTools (component: Panel Processor). Affects versions 8.61 and 8.62. Easily exploitable by an unauthenticated attacker with network access via HTTP, but requires user interaction. Successful attack allows unauthorized modification and read access to data.
Vulnerability in Oracle Workflow (Workflow Notification Mailer component) versions 12.2.3-12.2.15. Requires privileged local access and is difficult to exploit. Can lead to complete denial of service (DOS) and unauthorized read, write, and modification of data.
Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component: Security) in multiple versions. Easily exploitable flaw allows an unauthenticated attacker with network access via multiple protocols to unauthorizedly update, insert, delete, or read a subset of data.
Vulnerability in Oracle Access Manager (component: Authentication Engine) versions 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable, requires user interaction, allows an unauthenticated attacker via HTTP to unauthorized read and modify data.
Vulnerability in the Optimizer component of MySQL Server and MySQL Cluster. A high-privileged attacker can remotely cause a hang or frequent crashes (full DOS).
Netty versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, but due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Vulnerability in libheif before version 1.22.0. Decoding a malicious HEIF file without an `ispe` property (but with `uncC`) causes a crash in `heif_image_handle_get_image_tiling()` – via assertion in debug builds or null pointer read in release/ASan builds.
Vulnerability in libheif before version 1.22.0 causes a heap buffer overflow when reading HEIF/AVIF files. The Track::init_sample_timing_table() function stores an invalid chunk index, leading to an out-of-bounds read.
Vulnerability in libheif before version 1.22.0. The fix for CVE-2026-3949 introduced an integer overflow in the security check, allowing bypass and triggering an out-of-bounds heap read via a crafted HEIF file with a VVC track.
Vulnerability in libheif versions 1.19.0 through 1.21.2 allows a heap out-of-bounds write in the uncompressed tile decoder. A crafted HEIF file can overwrite the vtable pointer, leading to code execution.
Vulnerability in MySQL Server and MySQL Cluster (component: Server: Optimizer) in multiple versions. Easily exploitable flaw allows a low-privileged attacker with network access via multiple protocols to cause a hang or frequent repeatable crash (complete DOS) of MySQL Server or Cluster.
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.12. It is easily exploitable, requires local access and low privileges. Successful attack can cause a hang or frequent crashes (full DOS) of VirtualBox.
Vulnerability in the JDBC component of Oracle Database Server allows an unauthenticated attacker with access to the communication segment to gain unauthorized access to critical data. Requires user interaction.
Vulnerability in the JDBC component of Oracle Database Server (versions 19.3-19.31, 21.3-21.22, 23.4.0-23.26.2). An unauthenticated attacker via Oracle Net, requiring user interaction, can gain unauthorized access to critical data (modify, delete, create).
Easily exploitable vulnerability in Oracle VM VirtualBox 7.2.12, requiring user interaction. A low-privileged attacker can modify critical data and cause partial denial of service.
Vulnerability in Oracle MySQL's MySQL Server and MySQL Cluster products (component: InnoDB). Affected versions include MySQL Server 8.4.0-8.4.10, 9.7.0-9.7.1 and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1. Easily exploitable by a high-privileged attacker with network access via multiple protocols, potentially causing a hang or frequent crash (full DOS) of the server or cluster.
Vulnerability in PeopleSoft Enterprise PeopleTools (Security component) allows a low-privileged attacker via HTTP to gain unauthorized read and modify access to data. Requires user interaction.
Vulnerability in Oracle PeopleSoft Enterprise PeopleTools, component PIA Core Technology. Affects versions 8.61 and 8.62. Allows a high-privileged attacker with network access via HTTP to gain unauthorized access to critical data or all PeopleTools data.
Vulnerability in PeopleSoft Enterprise PeopleTools (Security component) allows a low-privileged attacker via HTTP to gain unauthorized read and modify access to data. Requires user interaction.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS