CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in Oracle Data Integrator (Rest Service component) allows an unauthenticated attacker via HTTP to fully compromise the system. The attack impacts additional products (scope change).
Vulnerability in Oracle Net Services (part of Oracle Database Server) allows an unauthenticated attacker remote access to critical data and can cause a complete denial of service (DOS). CVSS score is 9.1.
Vulnerability in Siebel CRM Development (Siebel Approval Manager component) allows an unauthenticated attacker via HTTP to fully compromise the system.
Vulnerability in Oracle Enterprise Manager Base Platform (Agent Next Gen component) allows an unauthenticated attacker via HTTPS to fully compromise the system.
Vulnerability in Oracle Enterprise Manager Base Platform (component: UI Framework) versions 13.5 and 24.1. A low-privileged attacker with network access via HTTPS can compromise the platform, gaining unauthorized access to critical data, as well as update, insert, or delete access, and cause partial denial of service. CVSS 9.1.
Vulnerability in Oracle Retail Integration Bus (RIB Kernal component) allows an unauthenticated attacker to compromise the system over HTTP. CVSS score is 9.8.
Vulnerability in Oracle Retail Integration Bus (RIB Kernal component) allows an unauthenticated attacker via HTTP to fully compromise the system.
Vulnerability in Oracle Application Testing Suite (version 13.3.0.1) allows an unauthenticated attacker via TCP to fully compromise the system.
Vulnerability in Oracle Application Testing Suite (version 13.3.0.1) allows an unauthenticated attacker to remotely compromise the system via Oracle Net. CVSS score is 9.8.
Vulnerability in Oracle Application Testing Suite (version 13.3.0.1) allows an unauthenticated attacker to remotely compromise the system via TCP. CVSS score is 9.8.
Autel Maxi Charger Single firmware up to version V1.03.51 contains a hard-coded authentication token that bypasses authorization checks for multiple management endpoints. An attacker can use this token to invoke privileged functionality without valid authentication.
The Keep tool (commit 91c75e0) is vulnerable to server-side request forgery (SSRF) in the unprotected healthcheck endpoint. Unauthenticated attackers can send a crafted JSON with a malicious host parameter, forcing the backend to issue requests to internal services or cloud metadata endpoints.
SQL injection vulnerability in Wgcloud 3.6.4. A remote attacker can escalate privileges via the PortInfoMapper.xml file.
SQL injection vulnerability in Crocus v.1.3.44. A remote attacker can escalate privileges via the RecordStateMapper.xml file.
SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the DeviceInfoMapper.xml file.
In MCP-for-Stata prior to version 1.17.3, the `log_file_name` parameter in the `stata_do` API and CLI is directly interpolated into a Stata command string without sanitization. The `GuardValidator` only scans the do-file content but does not validate this parameter. An attacker can inject arbitrary Stata commands (including `shell`, `python`, `erase`) by crafting a malicious `log_file_name` containing quotes, newlines, or Stata command separators.
In the bytebot-ai project at commit 3d37894ce07ef8d8b40adc7fd309ad96c2a71313 (2025-09-11), a vulnerability allows attackers to execute arbitrary code via a crafted path to the computer_write_file function.
A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality.
Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint.
Vulnerability in Data::DisjointSet::Shared for Perl before version 0.02 allows out-of-bounds reads and writes via an unvalidated parent index in dsu_find. The dsu_validate_header checks header scalars and region layout against file size but does not validate the array contents. A local attacker with write access to the backing file can poison the parent array, leading to out-of-bounds memory access.