CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A cross site scripting (XSS) vulnerability has been identified in SourceCodester Ship Ferry Ticket Reservation System version 1.0 in the user management function. Manipulating the 'Username' argument allows for remote exploitation.
7-Zip versions 9.11 through 26.00 contain a heap out-of-bounds read vulnerability in the UDF file identifier descriptor parser. The issue occurs when processing UDF images, potentially leading to information disclosure and application crashes.
Zidentyfikowano słabość w thedotmack claude-mem do wersji 11.0.1. Problem dotyczy funkcji computeObservationContentHash w pliku src/services/sqlite/observations/store.ts, co prowadzi do użycia słabego hasha.
Wykryto podatność w onnx-mlir do wersji 0.5.0.0, dotycząca funkcji generate_hash_key w pliku backend.py. Problem ten prowadzi do użycia słabego hasha, co może być wykorzystane w ataku lokalnym, chociaż jego realizacja jest skomplikowana.
The vulnerability in Samsung Auto prior to versions 3.1.2.61 (Android 15) and 3.2.0.38 (Android 16) is due to improper export of application components. This allows a local attacker to change the audio configuration.
Nieprawidłowy eksport komponentów aplikacji android w ImsSettings przed wydaniem SMR czerwiec 2026 Release 1 umożliwia lokalnym atakującym wywołanie funkcji logowania.
In org.keycloak.services, an administrator with delegated access to read group memberships and users can bypass user profile permissions by accessing the group members endpoint, allowing them to view user attributes that are explicitly denied.
A vulnerability in bytedance InfiniStore up to version 0.2.33. The purge_kv_map function in the /src/infinistore.h library (KV Map Handler component) causes inefficient algorithmic complexity. The attack requires local access. The exploit has been published.
Insufficient policy enforcement in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass discretionary access control via a crafted HTML page. (Severity: Low)
Google Chrome on Android prior to version 149.0.7827.53 has a vulnerability in CustomTabs due to insufficient policy enforcement. A remote attacker can leak cross-origin data via a crafted HTML page.
Vulnerability in Google Chrome prior to version 149.0.7827.53. Insufficient input validation in WebAuthentication allows an attacker who compromised the renderer process to bypass same origin policy via a crafted HTML page.
Insufficient validation of untrusted input in Loader in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Severity: Low)
In OpenStack Neutron before version 28.0.1, a project manager can create or update a port on a shared network owned by another project and set device_owner to a value starting with "network:". Default port RBAC policies incorrectly included PROJECT_MANAGER without requiring network ownership, allowing any project manager to obtain trusted network-service port behavior on shared networks. Depending on backend and deployment, this can bypass anti-spoofing and security group protections, enabling DHCP, MAC, or IP spoofing against other tenants on the shared network. This is a regression of CVE-2015-5240.
Vulnerability in LMCache up to 0.4.6. The hex_hash_to_int16 function in lmcache/integration/vllm/utils.py (KV Cache Handler component) uses a weak hash. Attack requires local access and high complexity. Exploit is publicly available.
In Strawberry GraphQL versions 0.288.4 through 0.315.3, the bundled GraphiQL template wrote header editor values into the browser URL query string. This could expose sensitive headers like authorization tokens.
Vulnerability in GPTCache up to 0.1.44. The BufferedReader.peek function in gptcache/processor/pre.py (Cache Key Handler component) uses a weak hash for the input_data["image"] argument. Attack requires local access and high complexity. Exploit is publicly available.
HCL BigFix Cloud Lifecycle Management lacks input validation. This low-level flaw allows unauthorized access and may lead to information exposure.
Vulnerability in Streamlit up to 1.53.0. An unknown function in lib/streamlit/runtime/caching/hashing.py (Palette Handler component) uses a weak hash. Attack requires local access and high complexity. Exploit is publicly available.
In MLflow up to version 3.10.0, a flaw in mlflow.data.digest_utils causes use of a weak hash function. The attack is local, high complexity, difficult to exploit, but an exploit has been published.
HCL iControl v4.0.0 discloses a stack trace due to an unhandled exception when JavaScript code attempts to read the 'dashboard key' property from an undefined object, possibly due to a missing or improperly initialized variable.