CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.19)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SSHFS from version 1.4 until 3.7.6 accepts a bracketed mount source such as [-oProxyCommand=CMD]:/path and find_base_path() removes the brackets, leaving a host value that begins with - and is passed directly to ssh as a command-line argument. When a caller also supplies a path-valued sftp_server, an injected ProxyCommand can execute locally before any connection or authentication succeeds. This issue is fixed in version 3.7.6.
Gotenberg from version 8.10.0 until 8.33.0 has a race condition in the newContext function in pkg/modules/api/context.go, where multiple goroutines concurrently write to shared maps and slices. A crafted multipart request with many downloadFrom entries can trigger a fatal 'concurrent map writes' runtime error and terminate the process. The default configuration allows unauthenticated remote attacks, leading to denial of service. This issue is fixed in version 8.33.0.
Gotenberg in version 8.32.0 and earlier has a vulnerability in the IsPublicIP function that does not reject IPv6 prefixes such as 2002::/16, 64:ff9b::/96, fec0::/10, and others that can embed or route to non-public IPv4 destinations. A crafted DNS AAAA record can cause the outbound HTTP client to treat an address wrapping an internal destination (e.g., 169.254.169.254) as public, allowing access to cloud metadata services. This issue is fixed in version 8.33.0.
MyBooks (Talebook) in version 3.41.2 and earlier has a vulnerability in the AdminSettings.post handler for POST /api/admin/settings, which does not check the self.admin_user property despite having the auth decorator. Any authenticated regular user can overwrite server configuration values including SMTP credentials, OAuth client secrets, storage paths, and security feature flags. Additionally, the process_auth_header function fails to verify the account's active flag, allowing unactivated accounts to authenticate. This issue is fixed in version 3.42.0.
Gotenberg in version 8.32.0 and earlier has a vulnerability in filename handling where filepath.Base on Linux does not treat backslashes as path separators, so a multipart filename containing Windows-style parent directory components survives sanitization. A remote attacker can submit such a name, and when the resulting archive is extracted on a Windows system, files can be written outside the intended directory. This issue is fixed in version 8.33.0.
Dell RecoverPoint for VMs, versions 6.0.3 and 6.0.3.1, contains an OS Command Injection vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to command execution.
HumHub Community Edition 1.18.4 contains a reflected XSS vulnerability in the space membership-request workflow. An attacker can place attacker-controlled button configuration in the options query-string parameter of the request-membership-form, lure an authenticated non-member into submitting the legitimate form, and cause the server to return JavaScript containing attacker-controlled code.
HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting (XSS) vulnerability in the oEmbed confirmation rendering workflow.
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a NULL pointer dereference.
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow.
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an out-of-bounds write.
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper privilege management.
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to access NFS-exported filesystems due to improper authentication.
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to gain unauthorized access to AIX systems due to improper validation of TLS certificates.
The nimesis registration service in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to overwrite files due to a path traversal vulnerability.
The NIM server process in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 crashes during client registration due to a buffer overflow.
The stigmem package (stigmem-node) version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-token validation that can cause valid peer tokens to be incorrectly treated as expired. This affects the availability and reliability of authenticated federation flows. Fixed in 0.9.0a2.
stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned (potentially malicious) plugin code could be loaded and executed, resulting in arbitrary code execution. Fixed in 0.9.0a2.