CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.20)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Lucky 13 vulnerability in HCL Aftermarket EPC allows a man-in-the-middle attack on TLS 1.1, 1.2, DTLS 1.0/1.2, and older SSL 3.0 and TLS 1.0 protocols. An attacker can exploit this flaw to decrypt network traffic.
An out-of-bounds write vulnerability was found in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on ARM, leading to buffer overflows. The issue is present in the shake.c and sha3.c files under native_c/arm/sha.
A buffer overflow vulnerability in KerOS software of Kerlink Wirnet iStation 868 version 4.3.3_20200803132042 allows a remote attacker to obtain sensitive information via the update URLs component.
In CoreDNS from version 1.9.4 to 1.14.5, a network DNS client requesting AXFR zone transfer can trigger a panic when configured with k8s_external headless-service zone transfers and a headless service endpoint with no declared ports. Fixed in version 1.14.5.
In cyrus-imapd up to version 3.12.2, a vulnerability was discovered involving heap exposure during parsing of nested MIME comments. An authenticated IMAP user can craft an email message containing an RFC 822 comment ending with a backslash, causing the server to read past the message's end in memory and return heap content.
In cyrus-imapd up to version 3.12.2, an issue was discovered where URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.
In cyrus-imapd up to version 3.12.2, a vulnerability allows GENURLAUTH-issued tokens to bypass ACLs. Any authenticated user can mint a URLAUTH token for any mailbox they can name, even without read access, enabling reading of mail from that mailbox.
In cyrus-imapd up to version 3.12.2, a vulnerability was found in the XAPPLEPUSHSERVICE command. An authenticated IMAP user can probe for the existence of arbitrary mailboxes on other users' accounts and hijack push notifications for new mail in those mailboxes to their own APNS device.
In dbt-mcp before 1.17.1, DefaultUsageTracker.emit_tool_called_event() serializes the complete arguments dictionary of every MCP tool call and sends it via dbtlabs_vortex.producer.log_proto without redaction, including sql_query, vars, and node_selection. Telemetry is enabled by default unless DBT_SEND_ANONYMOUS_USAGE_STATS=false or DO_NOT_TRACK=1 is set.
In dbt-mcp (MCP server for dbt) before version 1.17.1, the call_tool() function logs raw arguments at INFO level, and configure_file_logging() writes them to dbt-mcp.log, potentially exposing sensitive SQL queries, variables, and node selections in plaintext without automatic rotation or deletion.
HCL DFXAnalytics is missing the HTTP Strict-Transport-Security (HSTS) header, allowing a remote attacker to downgrade the connection to unencrypted HTTP and perform man-in-the-middle (MitM) attacks.
The vulnerability in HCL DFXAnalytics is due to the missing SameSite attribute on session cookies generated during authentication. This could allow a remote attacker to perform Cross-Site Request Forgery (CSRF) attacks if additional mitigations, such as Anti-CSRF tokens, are not implemented.
HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. The application includes internal IP address details within its generated server responses, which could allow a remote attacker to gather sensitive network topology information and use it to map the internal infrastructure for further targeted attacks.
HCL DFXAnalytics is affected by a Login Replay Attack vulnerability. A remote attacker can intercept, delay, or fraudulently retransmit valid authentication data to achieve unauthorized access.
HCL DFXAnalytics fails to set the "secure" attribute on session cookies generated during authentication. This vulnerability allows a remote attacker to intercept network traffic and capture sensitive cookies, session tokens, or credentials sent in cleartext over unencrypted channels.
The RTMKit WordPress plugin before version 2.0.9 fails to perform a proper capability check on one of its builder AJAX actions. Users with at least the Author role can create and activate a site-wide template that overrides the header, footer, or other global areas displayed to all visitors, which is normally restricted to administrators.
The RTMKit WordPress plugin before version 2.0.9 fails to perform a capability check in one of its AJAX actions and directly resolves a request-supplied post identifier, allowing users with at least the Contributor role to read the titles of other users' private, draft, pending, scheduled, and trashed posts.
A heap overflow in the evalcommand() function (shell/ash.c) of BusyBox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
A stack overflow vulnerability exists in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9. Attackers can cause a Denial of Service (DoS) by supplying a crafted AWK script.
Node Version Manager (nvm) versions 0.32.1 through 0.40.5 are vulnerable to path traversal when parsing LTS codenames from a mirror. A malicious mirror can inject path sequences like "../../../.bashrc", causing nvm to write version strings outside the intended alias directory, potentially overwriting shell startup files.