CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.20)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in Oracle Enterprise Manager Base Platform 24.1 allows a low-privileged attacker with network access via HTTPS to modify data, requiring user interaction.
Vulnerability in Oracle Retail Xstore Point of Service, component Xstore Mobile, version 21.0.3. A low-privileged attacker with local access can gain unauthorized read access to a subset of data.
In the DesignWare SPI driver (drivers/spi/spi_dw.c) in Zephyr up to v4.4.0, lack of validation of config->frequency allows an unprivileged thread with access to the SPI device to trigger an unsigned integer divide-by-zero. This causes a CPU exception and local denial of service. Requires CONFIG_USERSPACE=y and granted permissions.
MediaCMS 8.2.0 has an information disclosure vulnerability allowing authenticated users to access private media metadata of other users by adding media tokens to their own playlist without access control. Attackers can use a PUT request to the playlist API with a known token and then read private fields like title, description, view count, file size, and author username.
Tanium Server has a vulnerability involving User Interface Misrepresentation of Critical Information.
Data::SpatialHash::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created with mode 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing.
Vulnerability in Data::Intern::Shared for Perl before version 0.02 creates a world-readable mmap backing file and opens it without O_EXCL and O_NOFOLLOW flags. This allows a local attacker to read IPC data and exploit a race condition or symlink.
Vulnerability in Data::RingBuffer::Shared for Perl before version 0.04 creates a world-readable mmap backing file and opens it without O_EXCL and O_NOFOLLOW flags. This allows a local attacker to read IPC data and exploit a race condition or symlink.
Vulnerability in Data::HashMap::Shared for Perl before version 0.14 creates a world-readable mmap backing file and opens it without O_EXCL and O_NOFOLLOW flags. This allows a local attacker to read IPC data and exploit a race condition or symlink.
Vulnerability in Data::RadixTree::Shared for Perl before version 0.02 creates a world-readable mmap backing file and opens it without O_EXCL and O_NOFOLLOW flags. This allows a local attacker to read IPC data and exploit a race condition or symlink.
Vulnerability in Data::SortedSet::Shared for Perl before version 0.03 creates a world-readable mmap backing file and opens it without O_EXCL and O_NOFOLLOW flags. This allows a local attacker to read IPC data and exploit a race condition or symlink.
Vulnerability in Data::ReqRep::Shared for Perl before version 0.05 creates a world-readable mmap backing file and opens it without O_EXCL and O_NOFOLLOW flags. This allows a local attacker to read IPC data and exploit a race condition or symlink.
Vulnerability in Data::PubSub::Shared for Perl before version 0.07 creates a world-readable mmap backing file and opens it without O_EXCL and O_NOFOLLOW flags. This allows a local attacker to read IPC data and exploit a race condition or symlink.
Vulnerability in Data::NDArray::Shared for Perl before version 0.02. The mmap backing file is created with mode 0666, resulting in 0644 (world-readable) under default umask 022. Missing O_EXCL and O_NOFOLLOW flags allow a local attacker to follow a symlink or replace the file before creation.
Vulnerability in Data::Graph::Shared for Perl before version 0.04 creates a world-readable mmap backing file and opens it without O_EXCL and O_NOFOLLOW flags. This allows a local attacker to read IPC data and exploit a race condition or symlink.
Vulnerability in Data::Deque::Shared for Perl before version 0.06 creates a world-readable mmap backing file and opens it without O_EXCL and O_NOFOLLOW flags. This allows a local attacker to read IPC data and exploit a race condition or symlink.
Vulnerability in SoupAuthManager that caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leading to credential leakage.
Concurrent Login vulnerability in HCL MyCloud increases the risk of unauthorized access, session hijacking, and account misuse.
HCL MyCloud is affected by the SSL/TLS LUCKY13 vulnerability. An attacker can decrypt sensitive information via a TLS/SSL padding oracle attack.
HCL MyCloud has a missing Cookie Attribute Path vulnerability. This increases the risk of unauthorized access to session data or authentication tokens.