CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, and 2026.2.18095, missing authorization allowed an authenticated user to delete arbitrary entities via the mailbox endpoint.
In PostCSS before 8.5.18, loadMap() in lib/previous-map.js passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map.
In New API before 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation, allowing an unauthenticated attacker to cause memory pressure, container restarts, or disk exhaustion without forging a successful payment.
A memory-corruption vulnerability exists in a kernel-mode component of BeyondTrust Endpoint Privilege Management (Windows deployments) prior to version 26.1.2, due to insufficient validation of input, potentially leading to out-of-bounds memory access.
In UpTrain version 0.7.1 and prior, the /new_run endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user with access to UpTrain and a valid authentication method may be able to execute arbitrary code in the context of the host running UpTrain, which in most cases will be the docker container.
In UpTrain version 0.7.1 and prior, the /add_prompts endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user with access to UpTrain and a valid authentication method may be able to execute arbitrary code in the context of the host running UpTrain, which in most cases will be the docker container.
UpTrain version 0.7.1 and earlier contains a remote code execution vulnerability in the `/create_project` endpoint via the `checks` and `metadata` parameters. Any user with access to UpTrain and valid authentication can execute arbitrary code in the context of the host running UpTrain, usually a Docker container. No patch is available as of publication.
UpTrain version 0.7.1 and earlier creates a default user with a static username, which is also used as the default API key. The backend has an open CORS policy, allowing any website to make authenticated cross-origin requests using the default API key in the `uptrain-access-token` header. This may allow arbitrary websites to perform privileged operations on the UpTrain instance.
In openshift-metal3/fakefish, some shell scripts inject variables without quoting them into command lines or manifests. This mostly applies to the Image URL and BMC credentials, which are not verified by FakeFish.
OpenText Directory Services through version 22.2 contains an input data manipulation vulnerability.
Dell ObjectScale versions prior to 4.3.0.1 contain an OS Command Injection vulnerability. A low privileged attacker with local access could exploit this to elevate privileges.
Dell ObjectScale versions prior to 4.3.0.1 contain a Path Traversal vulnerability. A low privileged attacker with local access could exploit this to tamper with information.
Dell ObjectScale versions prior to 4.3.0.1 contain an OS Command Injection vulnerability. A low privileged attacker with local access could exploit this to elevate privileges.
Dell ObjectScale versions prior to 4.3.0.1 contain an OS Command Injection vulnerability. A low privileged attacker with local access could exploit this to execute commands.
Dell ObjectScale versions prior to 4.3.0.1 contain an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could exploit this to elevate privileges.
extract-zip through 2.0.1 only checks the parent directory of each archive entry, not the entry's own final path component. An archive containing two entries with identical names – a symlink pointing outside the destination, followed by a regular file – writes through the symlink, allowing arbitrary file write outside the destination directory.
Missing Authorization vulnerability in Dolusoft Software Technologies Sonlogger allows accessing functionality not properly constrained by ACLs. This issue affects Sonlogger from v6.6.6 before 6.7.4.8.
In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions; RCE is not confirmed on v6.
In Progress ShareFile Storage Zones Controller v5.12.5 and below, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary code on the Storage Zones Controller host.
In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result in the execution of attacker-supplied code.