CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in Axios, an HTTP client, allows for the injection of malicious data into the Proxy-Authorization header if the proxy object is polluted. The issue exists in versions from 1.15.2 to before 1.16.0, where the setProxy() function does not check object properties.
A vulnerability was identified in version 5.36.0 of the TwiN gatus component, concerning the setSessionCookie function in the security/oidc.go file. Manipulating this function can lead to sensitive cookies without the secure attribute.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2. Under certain conditions, an unauthenticated user could impersonate the GitLab Support Bot and inject arbitrary content via a specially crafted Service Desk email reply due to improper neutralization in email template processing.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2. Under certain conditions, an authenticated user with developer-role permissions could hide changes from merge request diff views due to improper input handling of file names.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2. Under certain conditions, this could have allowed an authenticated user to access confidential issue details due to incorrect authorization checks.
In Spring Web Services (versions 5.0.0-5.0.1, 4.1.0-4.1.3, 4.0.0-4.0.18, 3.1.0-3.1.8) the Wss4jSecurityInterceptor did not properly wire ReplayCache instances into RequestData, making replay protections ineffective for UsernameToken nonces, timestamps, and SAML.
A vulnerability in Dulwich (versions 0.24.0 through 1.2.4) allows writing patch files outside the intended directory via a malicious commit subject. The format_patch function derives filenames from commit subjects without sanitizing path separators or parent-directory components.
Shopware before versions 6.6.10.18 and 6.7.10.1 allows an attacker to enumerate administrator usernames via a timing attack.
In SpiceDB from version 1.15.0 to before 1.52.0, caveat structures with nested lists can result in improper cache reuse. This issue has been patched in version 1.52.0.
Vulnerability in bit7z library before version 4.0.12 causes an off-by-one error in SafeOutPathBuilder::restoreSymlink(), allowing a crafted .7z archive to create a symlink outside the intended output directory on non-Windows platforms, enabling arbitrary file writes.
A person with access to a Mac may bypass the Login Window. The issue is fixed in macOS Monterey 12.4 with improved state handling.
Fission is a serverless framework that operates on Kubernetes and had a vulnerability in path validation prior to version 1.25.0. The SanitizeFilePath function did not properly check directory boundaries, allowing access to unsafe directories.
Crawlee is a web scraping and browser automation library. From version 1.0.0 to before version 1.7.0, Crawlee is vulnerable to SSRF via sitemap-derived URLs. This issue has been patched in version 1.7.0.
A path traversal vulnerability in Ghidra before version 12.1 in the SameDirDebugInfoProvider component allows attackers to inject traversal sequences into file paths. By crafting malicious ELF binaries with a .gnu_debuglink section, it is possible to probe filesystem existence and leak CRC32 hashes of arbitrary files during automatic DWARF analysis.
Ghidra before version 11.2 contains a use-after-free vulnerability in the Sleigh backend caused by undefined static initialization order of the SleighArchitecture::translators and XmlArchitectureCapability singletons. Attackers can trigger an infinite loop or denial of service during shutdown by exploiting the unsafe destruction order that causes iteration over deallocated memory.
CVE-2026-11859 describes an HTML injection vulnerability in the 'fetch links' emails sent by Thinkst Applied Research Canarytokens, allowing for Interface Manipulation and Cross-Site Scripting (XSS) in email clients that render HTML emails.
Vulnerability in Store Locator WordPress plugin before 1.6.6 allows high-privileged users to perform Stored XSS attacks even when unfiltered_html is disallowed (e.g., in multisite).
A vulnerability in some Dahua products allows an attacker to obtain the device's CA root certificate. If that CA is installed and trusted on client systems, the attacker can issue fraudulent certificates, undermining the certificate trust chain.
QTS, QuTS hero, and QuTScloud are not affected by this vulnerability. The vendor has already fixed the vulnerability in the following version: [no further details in description].
Vulnerability in Spring Security SAML allows attackers to decrypt SAML Responses and LogoutRequest/LogoutResponse elements without a valid signature, enabling the Service Provider to be used as a decryption oracle. Affects versions 5.7.0-5.7.23, 5.8.0-5.8.25, 6.3.0-6.3.16, 6.4.0-6.4.16, 6.5.0-6.5.10, 7.0.0-7.0.5.