CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In OpenStack Ironic before version 35.0.2, in a certain configuration, the instance 'instance_info['ks_template']' is rendered without proper sandboxing.
In Paramiko through 4.0.0 before commit a448945, the rsakey.py file allows the SHA-1 algorithm.
A vulnerability in Langchain-Chatchat up to version 0.3.1.3 in the _get_file_id function of the Uploaded File Handler component generates insufficiently random values, potentially allowing an attacker to predict file IDs. The attack requires local network access and is considered difficult.
In Langchain-Chatchat up to version 0.3.1.3, the OpenAI-Compatible File Upload API has a time-of-check time-of-use (TOCTOU) vulnerability when processing the file.filename argument. The exploit is public and the project has not responded.
In Langchain-Chatchat up to 0.3.1.3, a vulnerability was found in the function PIL.Image.tobytes of dialogue.py in the Vision Chat Paste Image Handler component. Manipulation of the paste_image.image_data argument leads to use of weak hash. Local network access is required and the attack is difficult.
A vulnerability in Postfix before versions 3.8.16, 3.9.10, and 3.10.9 allows a buffer over-read and process crash via an enhanced status code that lacks text after the third number.
A logic flaw was found in GnuTLS when processing multi-record OCSP responses. A remote attacker can exploit this during a TLS handshake by sending a crafted OCSP response, causing a client with OCSP verification enabled to incorrectly accept a revoked server certificate.
Insufficient validation of untrusted input in the Compositing component in Google Chrome prior to 147.0.7727.138 allows a remote attacker who has compromised the renderer process to bypass site isolation via a crafted HTML page.
Race condition vulnerability in MHTML in Google Chrome prior to 147.0.7727.138. An attacker who convinces a user to install a malicious extension can leak cross-origin data via a crafted Chrome Extension. (High severity per Chromium).
In Xuxueli xxl-job up to 3.3.2, the logDetailCat function lacks control of resource identifiers (logId), allowing remote attack with high complexity.
A cross-site scripting vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0 in the file /admin/ajax.php?action=save_user via manipulation of the Name argument. The attack can be executed remotely and the exploit is publicly available.
A cross-site scripting vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0 in the file /admin/ajax.php?action=save_order via manipulation of the first_name argument. The attack can be executed remotely and the exploit is publicly available.
SourceCodester Pizzafy Ecommerce System 1.0 is vulnerable to XSS in the save_menu function of /admin/ajax.php?action=save_menu via the Name argument. The attack is remote and the exploit is public.
XSS vulnerability in Coaching Management System 1.0 in file /cims/modules/student/complaint.php. Manipulation of the Complaint argument allows remote cross-site scripting. Exploit is publicly available.
A vulnerability in the uuid library before version 14.0.0 allows unexpected writes to external output buffers when generating UUID versions 3, 5, or 6. UUID version 4, which is very commonly used, is unaffected by this issue.
The vulnerability in libexpat before version 2.8.0 is due to insufficient entropy, allowing a hash flooding attack via a crafted XML document.
A cross-tenant isolation vulnerability was found in Grafana's Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in >=11.6.11, >=12.0.9, >=12.1.6, and >=12.2.4.
A regression introduced in OAuth2 Proxy 7.11.0 prevents clearing the session cookie when rendering the sign-in page. In deployments relying on the sign-in page as part of the logout flow, a user may be shown the sign-in page while the existing session cookie remains valid, meaning the browser session is not actually logged out. On shared workstations, a subsequent user could continue the previous user's authenticated session. This is fixed in version 7.15.2.
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. A high-privileged attacker could exploit this vulnerability and exhaust system resources, reducing application speed. Exploitation of this issue does not require user interaction.
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. A high-privileged attacker could exploit this vulnerability and exhaust system resources, reducing application speed. Exploitation of this issue does not require user interaction.