CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.11)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in PeopleSoft Enterprise CS Campus Community product (component: Self-Service) version 9.2. Allows a low privileged attacker with network access via HTTP to gain unauthorized read access to a subset of data, potentially impacting additional products.
W Arm Mbed TLS przed wersją 2.16.6 oraz 2.7.x przed wersją 2.7.15 odkryto problem, który pozwala atakującemu na odzyskanie długoterminowego klucza prywatnego ECDSA. Atak opiera się na pomiarach bocznych, które umożliwiają rekonstrukcję współrzędnych projektowych oraz wykorzystanie ataków do uzyskania klucza prywatnego.
In MISP before version 2.4.124, the file app/Model/feed.php allows administrators to choose arbitrary files for ingestion. This does not leak the full contents of a file but can leak strings that match certain patterns, such as passwords from database.php or GPG key passphrases from config.php.
MISP version 2.4.122 has a Persistent XSS vulnerability in the sighting popover tool. This is related to the file app/View/Elements/Events/View/sighting_field.ctp.
MISP version 2.4.122 has a reflected XSS vulnerability via unsanitized URL parameters. This is related to app/View/Users/statistics_orgs.ctp.
A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to read or write arbitrary files on the underlying operating system. This is due to insufficient input validation. An attacker could exploit this by including crafted arguments to a specific CLI command, allowing arbitrary file read or write.
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to incorrect handling of directory paths.
An issue was discovered in MISP before version 2.4.121 where ACLs for discussion threads were mishandled in app/Controller/ThreadsController.php and app/Model/Thread.php.
An issue was discovered in MISP before version 2.4.121, which did not canonicalize usernames when trying to block a brute-force series of invalid requests.
An issue was discovered in MISP before version 2.4.121 that mishandled time skew between the web server and the database, potentially leading to ineffective protection against brute-force attacks.
In RubyGem excon before version 0.71.0, a race condition exists around persistent connections. An interrupted connection (e.g., due to a timeout) leaves data on the socket, which is read by subsequent requests, returning content from the previous response. The race condition window is narrow, making intentional exploitation difficult.
In MISP 2.4.118 in app/Controller/TagsController.php, users can bypass intended restrictions on tagging data.
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).
A vulnerability in the HTTP traffic filtering component of Cisco Firepower Threat Defense, FirePOWER Services for ASA, and Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. This is due to improper handling of HTTP requests, including over HTTPS, with maliciously crafted headers. An attacker could send malicious requests to bypass filtering and deliver malicious content to protected systems.
A vulnerability in the normalization functionality of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The issue is due to insufficient normalization of a text-based payload. An attacker could exploit this by sending traffic with specifically obfuscated payloads through an affected device.
A vulnerability in the protocol detection component of Cisco Firepower Threat Defense, FirePOWER Services for ASA, and Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. This is due to improper detection of initial protocol use on a nonstandard port. An attacker could send traffic on a nonstandard port to bypass filtering and deliver malicious requests to protected systems.
A vulnerability in the stream reassembly component of Cisco Firepower Threat Defense Software, FirePOWER Services Software for ASA, and Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The issue is due to improper reassembly of traffic streams. An attacker could exploit this by sending crafted streams through an affected device, potentially delivering malicious requests to protected systems.
Na urządzeniach Hyundai Pay Kasse HK-1000 odkryto kanał boczny związany z wyświetlaczem OLED opartym na wierszach. Zużycie energii przez każdy cykl wyświetlacza zależy od liczby podświetlonych pikseli, co umożliwia częściowe odzyskanie zawartości wyświetlacza.
A heap-based buffer over-read exists in the terminfo library of ncurses before version 6.1-20191012 in the fmt_entry function in tinfo/comp_hash.c.
A heap-based buffer over-read exists in the terminfo library of ncurses before version 6.1-20191012 in the _nc_find_entry function in tinfo/comp_hash.c.