CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model.
A vulnerability in BTstack prior to version 1.8.1 allows an out-of-bounds read in the AVRCP Controller GET_PLAYER_APPLICATION_SETTING_ATTRIBUTE_TEXT and GET_PLAYER_APPLICATION_SETTING_VALUE_TEXT handlers. An attacker within Bluetooth Classic range can send a crafted VENDOR_DEPENDENT response, leading to information disclosure and potential device crashes.
A vulnerability in BTstack prior to version 1.8.1 allows an out-of-bounds read in the AVRCP LIST_PLAYER_APPLICATION_SETTING_ATTRIBUTES and LIST_PLAYER_APPLICATION_SETTING_VALUES handlers. An attacker with a paired Bluetooth Classic connection can send a crafted VENDOR_DEPENDENT response with a controlled count value to trigger an out-of-bounds read from the L2CAP receive buffer, potentially causing a crash on resource-constrained devices.
A flaw was found in libssh in which a malicious SFTP server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap, causing unexpected behavior or denial of service (DoS) due to application crashes.
A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by causing the system to try and access dangerous files, such as block devices or large system files, which can disrupt normal operations.
Mattermost Plugins versions <=11.4 and 10.11.11.0 fail to validate webhook request timestamps, allowing an attacker to corrupt Zoom meeting state in Mattermost via replayed webhook requests.
A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` parameter during refresh token requests. This occurs when a Keycloak client is configured to use the `backchannel.logout.url` with the `application.session.host` placeholder.
The webbrowser.open() API in Python would accept URLs starting with dashes, which could be interpreted as command line options by certain web browsers. The new behavior rejects such URLs.
In libexpat before version 2.7.5, a NULL pointer dereference occurs in the setContext function on retry after a previous out-of-memory condition.
Moduł tarfile w Pythonie błędnie normalizował bloki AREGTYPE (\x00) do DIRTYPE podczas przetwarzania wieloblokowych członków archiwum, takich jak GNUTYPE_LONGNAME lub GNUTYPE_LONGLINK. Może to prowadzić do błędnej interpretacji spreparowanego archiwum tar w porównaniu z innymi implementacjami.
A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.
A potential vulnerability was reported in the Lenovo FileZ Android application that, under certain conditions, could allow a local authenticated user to retrieve some sensitive data stored in a log file.
Easy Grade Pro 4.1.0.2 contains a file parsing logic flaw in handling proprietary .EGP gradebook files. Modifying specific fields at precise offsets triggers an out-of-bounds memory read, causing an application crash.
W wyniku braku sprawdzenia autoryzacji w serwerze aplikacyjnym SAP NetWeaver dla ABAP, uwierzytelniony atakujący mógłby wykonać określony moduł funkcji ABAP i odczytać wrażliwe informacje z katalogu bazy danych systemu ABAP. Podatność ta ma niski wpływ na poufność aplikacji, nie wpływając na integralność i dostępność.
A vulnerability was detected in Mendi Neurofeedback Headset V4. It affects an unknown functionality of the Bluetooth Low Energy Handler. Manipulation results in cleartext transmission of sensitive information. The attack can only be performed from the local network, and its complexity is high, making exploitation difficult.
Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged operator to cause a limited denial-of-service in the Command Centre Server. Affected versions: 9.40 prior to vEL9.40.1976(MR1), 9.30 prior to vEL9.30.3382 (MR4), 9.20 prior to vEL9.20.3783 (MR6), 9.10 prior to vEL9.10.4647 (MR9), and all versions of 9.00 and prior.
A flaw was found in Keycloak's WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require direct attestation. This can lead to weakened authentication integrity and unauthorized authenticator registration.
VLC for Android prior to version 3.7.0 contains an authentication bypass in the Remote Access Server due to missing rate limiting on OTP verification. An attacker with network access can repeatedly attempt to guess the 4-digit OTP until a valid user session cookie is issued.
In Golioth Firmware SDK versions 0.19.1 through 0.21.0, there is an out-of-bounds read vulnerability due to improper null termination of a blockwise transfer path. The blockwise_transfer_init() function copies the path using strncpy() without guaranteeing a trailing NUL byte, leaving the buffer unterminated. A subsequent strlen() call on this buffer can read past the allocated memory, causing a crash or denial of service.
In Golioth Firmware SDK versions 0.10.0 through 0.22.0, there is an out-of-bounds read vulnerability in LightDB State string parsing. When payload_size is less than 2, a size_t underflow occurs when computing the number of bytes to copy, and the subsequent memcpy() reads past the end of the network buffer, potentially crashing the device.