CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In Apache Airflow, exploitation requires an already authenticated Airflow worker with a valid Log-server JWT for at least one Dag. The Log server authorized JWT tokens against Dag IDs by applying Python's `str.lstrip()` to the requested path segment when verifying the JWT's `sub` claim. `str.lstrip()` strips any character from a set, not a prefix, so a JWT for a Dag named `dag_a` would authorize log access to any other Dag whose name began with any subset of characters `{d, a, g, _}`. An authenticated worker could enumerate and read worker logs of other Dags, leaking task output and error traces beyond the per-Dag isolation boundary.
The structure_data endpoint in the Airflow UI returned external dependency graph nodes for linked DAGs without checking whether the caller had read permission on those linked DAGs. An authenticated UI/API user authorized for one DAG could enumerate linked DAG IDs and dependency metadata for other DAGs they were not authorized to read.
An unknown part of the /webview/ file in the Campaign Handler component in Mettle sendportal up to version 3.0.1 is vulnerable to XSS via manipulation of the content argument. The attack can be performed remotely and the exploit is publicly available. The project was notified but has not responded.
In Assimp up to 6.0.4, the HL1MDLLoader::read_sequence_infos function has an out-of-bounds read via the aiString argument. Local access required; exploit public.
An unknown function in the file admission_form_check.php in raisulislamg4 student_management_system_by_php (up to version 310d950e09013d5133c6b9210aff9444382d16d1) is vulnerable to XSS via manipulation of the Message argument. The attack can be performed remotely and the exploit is publicly available. The project was notified but has not responded.
In STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules, incorrect permission handling allows gaining knowledge about the number of affected CIs, SLA, and services without gaining access to them.
In OTRS, the External Interface and ConfigItem List modules incorrectly handle permissions, allowing an authenticated customer to query the system for CI information. This affects only when CMDB is enabled and CustomerGroupSupport is used.
A vulnerability was detected in unitedbyai droidclaw up to 0.5.3 in the claim endpoint of server/src/routes/pairing.ts, involving improper restriction of excessive authentication attempts. The attack may be launched remotely but is difficult to exploit. The exploit is public. The project has not responded.
In Assimp up to 6.0.4, the FBXExporter::WriteObjects function has a divide-by-zero vulnerability. Local access required; exploit public.
A vulnerability in Assimp up to version 6.0.4 affects the glTF2::LazyDict function in glTF2Asset.h, leading to a null pointer dereference via the operator[] argument. Local access is required, and the exploit is public.
In Assimp up to 6.0.4, the Assimp::glTFImporter::ImportMeshes function has a null pointer dereference. Local access required; exploit public.
A vulnerability in Assimp up to version 6.0.4 affects the glTF2Importer::ImportEmbeddedTextures function in glTF2Importer.cpp, causing a null pointer dereference. Local access is required, and the exploit is public.
In the School Student Management System (OUSL-GROUP-BrinaryBrains) up to version 1e70e5ad1125b86dca4ee086eb6bb121f17708b6, a vulnerability was found in the ajax_forgot_password function in file application/controllers/Login.php (Forgot Password Endpoint). Manipulation of the email argument leads to weak password recovery. The attack can be launched remotely, is difficult, but the exploit is now public.
A cross-site scripting vulnerability was found in sambitraj STUDENT-MANAGEMENT-SYSTEM 1.0 on the Dashboard page. Manipulating the Name argument allows remote script execution. The exploit is public, and the project has not responded.
StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication state, including a JSON Web Token and asymmetric key material, in cleartext in a per-user state file at C:\Users\<username>\.sdm\state.kv. The file is protected only by default user-level NTFS permissions.
In Rizin, a heap-buffer-overflow exists in librz/bin/format/omf/omf.c. Fixed by commit e6d0937c8a083e23ed76ccfb9f631cdc50c7af47.
In Rizin, a double free vulnerability exists in byte_pattern_search() due to incorrect pointer ownership.
In NanoMQ MQTT Broker version 0.24.8 and earlier, quic_stream_recv can dereference a null substream pointer when a substream is in reopen state. The code finishes the AIO with error but does not return before locking c->mtx, potentially leading to crashes or other issues.
In JetBrains IntelliJ IDEA before 2026.1, the UI Designer form parser is vulnerable to XXE (XML External Entity) attacks.
A stored cross-site scripting vulnerability was found in JetBrains TeamCity before 2026.1 on the SAML login page. Attackers can inject a malicious script that executes on each login.