CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An insufficient entropy vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote users to predict secret via unspecified vectors.
A vulnerability has been reported affecting QNAP operating systems regarding the cleartext transmission of sensitive information. If exploited, local network clients may read unexpected sensitive data via unspecified vectors.
A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, where the session cookies attribute is not set properly. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation.
IBM Robotic Process Automation versions 21.0.0 through 21.0.7.1 is vulnerable to information disclosure of script content if the remote REST request policy is enabled.
In curl 7.65.2, an integer overflow occurs in tool_operate.c with a large retry delay value.
A vulnerability in Microsoft Edge (Chromium-based) allows for information disclosure. An attacker could exploit this flaw to gain access to sensitive user data.
A CSRF vulnerability in Chamilo versions 1.11 through 1.11.20 allows a remote authenticated privileged attacker to execute arbitrary code. The flaw is due to missing cross-site request forgery protections.
A vulnerability was found in Control iD Gerencia Web 1.30, affecting an unknown functionality of the Cookie Handler component. Manipulation leads to cleartext storage of sensitive information.
A vulnerability has been found in MaximaTech Portal Executivo version 21.9.1.140, affecting unknown code of the Cookie Handler component. The manipulation leads to missing encryption of sensitive data.
A vulnerability classified as problematic has been found in tdevs Hyip Rio 2.1. It affects some unknown functionality of the file /user/settings of the Profile Settings component, where manipulation of the avatar argument leads to cross site scripting.
Missing encryption in the RFID tag of Suleve 5-in-1 Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximity to the original device.
Missing encryption in the RFID tag of Digoo DG-HAMB Smart Home Security System v1.0 allows attackers to create a cloned tag via brief physical proximity to the original device.
A vulnerability in Keystone, an open source headless CMS for Node.js, allows public access to the `adminMeta` GraphQL query when `ui.isAccessAllowed` is set to `undefined`. This differs from the default behavior of the AdminUI middleware, which requires a session if a session strategy is defined.
A vulnerability was found in phpRecDB version 1.3.1 that allows cross site scripting (XSS) attacks through manipulation of the r/view argument in the /index.php file. The issue has been rated as problematic.
A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. A user could store such rows that are forbidden by UPDATE and SELECT policies but not by INSERT policies.
Mattermost fails to delete the attachments when deleting a message in a thread, allowing a simple user to still access and download the attachment of a deleted message.
An out-of-bounds write in Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA in version 0.25.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
Business logic errors in the GitHub repository froxlor/froxlor prior to version 2.0.22 and 2.1.0 may lead to unauthorized access or improper application behavior.
When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.
When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.