CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A weakness has been identified in jasypt-spring-boot up to version 3.0.5/4.0.4 in the getSecretKeySaltGenerator function of SimpleGCMConfig.java. Manipulation can lead to use of a one-way hash with a predictable salt. The attack can be launched remotely but requires high complexity and is difficult to exploit.
A vulnerability in vBulletin 6.x in an unknown function of the Login component leads to cross-site scripting (XSS). The attack can be initiated remotely. The exploit has been made public.
A security vulnerability has been detected in QuantumNous new-api up to version 0.12.1 in the function RelayMidjourneyImage/GetByOnlyMJId of file router/relay-router.go in the Midjourney Image Relay Endpoint component. Manipulation leads to authorization bypass. The attack can be launched remotely but is difficult.
The NewNTUnicodeString function does not check for string length overflow. When given a string exceeding the maximum NTUnicodeString size (16-bit byte count), it returns a truncated string instead of an error.
In TypeBot up to version 3.15.2, the bot engine's findResult query does not filter by typebotId, allowing an authenticated user to load result data from another typebot by supplying a foreign resultId to the startChat endpoint. This issue is fixed in version 3.16.0.
In Devolutions Server versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier, unverified password change allows an attacker to change a user's password without providing the previous one via a crafted password change request.
In Devolutions Server versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier, authorization bypass in the entry duplication feature allows an authenticated user with write access to any vault to copy documentation and attachments from an entry in a vault they cannot access via a crafted save request.
In Devolutions Server, insufficient logging in the entry export feature allows an authenticated user with export permissions to export a sealed entry without triggering the unseal notification to administrators via a crafted export request.
Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticated user with access to a sealed entry to retrieve its sensitive data without triggering the unseal audit notification via a crafted API request. This affects versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier.
Dell PowerFlex Manager versions up to 4.6.2 contain a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the SSH component. A low privileged attacker with local access can bypass protection mechanisms.
Vulnerability in STER prior to version 9.5. The application uses unencrypted TCP traffic to transmit data, enabling Man-In-The-Middle attacks and interception of sensitive data such as passwords or authentication tokens.
A time-of-check time-of-use (TOCTOU) condition in the ad_flush function in Netatalk 3.0.0 through 4.4.2 involves root-privileged file operations, potentially allowing a remote attacker to cause limited data modification under specific race conditions.
A missing break statement in DSI OpenSession processing in Netatalk 1.5.0 through 4.4.2 causes a fall-through from DSIOPT_ATTNQUANT to DSIOPT_SERVQUANT. A remote attacker can cause minor service disruption via crafted DSI session options.
Netatalk 2.1.0 through 4.4.2 combines multiple errno values using bitwise OR, resulting in incorrect error codes when multiple errors occur. A remote attacker can cause minor service disruption via conditions triggering incorrect error handling.
Netatalk versions 3.1.2 through 4.4.2 are compiled without FORTIFY_SOURCE, disabling built-in buffer overflow detection. A remote attacker can cause a minor denial of service via memory errors that would otherwise be safely terminated.
In Netatalk versions 3.0.0 through 4.4.2, a dead bounds check in the Spotlight RPC unmarshaller provides no effective bounds protection, potentially allowing a remote authenticated attacker to obtain limited information via crafted Spotlight RPC requests.
In Netatalk versions 2.0.0 through 4.4.2, an incorrect calculation in the hextoint macro due to improper uppercase character handling allows a remote authenticated attacker to cause limited data modification via crafted hexadecimal input.
A format string argument mismatch in Netatalk versions 3.0.3 through 4.4.2 allows a remote authenticated attacker to cause a minor denial of service via crafted input.
Vulnerability in Netatalk versions 2.2.1 through 4.4.2. The system() function is called after a failed chdir() without proper error handling, allowing a local privileged user to execute unintended commands or cause minor service disruption.
Unbounded memory reallocation in the charset conversion code in Netatalk 2.0.0 through 4.4.2 allows a remote authenticated attacker to cause a minor denial of service via crafted character conversion requests.