CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 Secrets may be disclosed in log files in IBM Storage Scale Management GUI The admin password is logged into the GUI log of IBM Storage Scale Systems Deploy and Upgrade from GUI. Secrets may be disclosed in information related to exceptions in IBM Storage Scale Management GUI.
IBM i versions 7.6, 7.5, 7.4, and 7.3 may allow a local authenticated attacker to trigger a stack-based buffer overflow in the native IBM i JSSE provider, caused by improper bounds checking during TLS session establishment. A local attacker could overflow a fixed-length buffer and execute arbitrary code on the system or cause the JVM process to crash.
IBM i versions 7.6, 7.5, 7.4, and 7.3 may allow a local authenticated attacker to gain privilege escalation via the Navigator for i debugger. This could allow the attacker to access or manipulate sensitive data on the system, or create new profiles with elevated privileges on the IBM i system.
IBM i versions 7.6, 7.5, 7.4, and 7.3 may allow a remote authenticated attacker to gain elevated privileges due to improper validation of pointers read from Java-controlled addresses.
IBM i versions 7.6, 7.5, 7.4, and 7.3 may allow a remote attacker to bypass security restrictions due to improper validation of user-controlled addresses.
IBM i versions 7.6, 7.5, 7.4, and 7.3 may allow a local attacker to gain elevated privileges due to improper management of thread authority swaps.
IBM i versions 7.6, 7.5, 7.4, and 7.3 may allow a remote attacker to cause a denial of service due to a stack-based buffer overflow.
IBM i versions 7.6, 7.5, 7.4, and 7.3 may allow a remote attacker to cause a denial of service due to an out-of-bounds write.
IBM Documentation Offline versions 1.0.0 through 1.4.1 may allow a remote attacker to execute arbitrary code due to improper output neutralization for logs.
IBM Documentation Offline versions 1.0.0 through 1.4.1 may allow a remote attacker to read arbitrary files due to improper limitation of a pathname to a restricted directory.
IBM i versions 7.6, 7.5, 7.4, and 7.3 may allow a remote attacker to cause a denial of service due to a buffer overflow.
IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code or obtain sensitive information due to improper authentication.
IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper authentication.
The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker service that listens on all network interfaces without authentication. An unauthenticated attacker with network access to the MQTT service on a vulnerable system can read data and control connected lights. Fixed in 1.77.2071318010.
Trigger.dev before version 4.5.2 contains a vulnerability in addGoogleStrategy() that passes a Google profile email to findOrCreateGoogleUser() without requiring Google's email_verified assertion. When an existing email-matched account exists, an attacker can take over the account using an unverified matching email from their own Google profile.
Trigger.dev from version 3.3.8 to 4.5.6 contains a vulnerability in the PUT /api/v1/runs/:runId/metadata endpoint, where operation.key values are passed to new JSONHeroPath(operation.key).set() without rejecting dangerous constructor and prototype path segments. A caller with a normal environment API key can pollute Object.prototype in the shared webapp process, corrupting Prisma queries and Prometheus labels, breaking other tenants' worker authentication, and causing a process-wide denial of service.
Flyto2 Core before version 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address `::` which the kernel routes to loopback identically to `0.0.0.0`. Attackers can submit requests or trigger 302 redirects to bypass the private IP range and blocked hostname checks in is_private_ip(), reaching services bound to IPv6 loopback across the http.get, http.request, and http.batch modules.
Kibana contains a Relative Path Traversal (CWE-23) vulnerability that can lead to unauthorized deletion of Kibana resources. Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored and later incorporated into the request when that configuration is removed.
Kibana contains a Missing Authorization (CWE-862) vulnerability that can lead to cross-space information disclosure and unauthorized data modification. Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to keep ML data separated. Part of the ML functionality did not apply that filter, so operations from one space were carried out against ML data of every space.
The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the requesting user's account. Only Kibana feature privileges are verified, not the caller's Elasticsearch index privileges. An authenticated user with Elastic Security feature privileges but no read access to Elastic Defend event indices can retrieve field values, including process command line arguments, which commonly contain tokens, credentials, and other sensitive operational detail.