CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.25)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper validation of the LANG environment variable.
IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service (DoS) due to a heap buffer overflow.
IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to a heap-based buffer overflow.
IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to system objects due to a time-of-check to time-of-use (TOCTOU) race condition involving symbolic links.
IBM i versions 7.6, 7.5, and 7.4 are vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
IBM i versions 7.6, 7.5, 7.4, and 7.3 contain a path traversal vulnerability that could allow a remote authenticated attacker to gain unauthorized access to arbitrary objects.
IBM i versions 7.6, 7.5, 7.4, and 7.3 contain a vulnerability due to improper validation of an attacker-controlled file path, which could allow a local authenticated attacker to change the ownership of arbitrary files.
IBM i versions 7.6, 7.5, 7.4, and 7.3 contain a TOCTOU race condition vulnerability that could allow a local authenticated attacker to obtain unauthorized access to files.
IBM i 7.6 contains an out-of-bounds write vulnerability that could allow a remote attacker to cause a denial of service.
IBM i versions 7.6, 7.5, 7.4, and 7.3 use uninitialized memory during ASN.1 length processing, which could allow a remote attacker to cause a denial of service.
IBM i versions 7.6, 7.5, 7.4, and 7.3 contain an improper authentication vulnerability during NTLM session negotiation, which could allow a remote attacker to access server resources with the privileges of an authenticated user.
IBM i versions 7.6, 7.5, 7.4, and 7.3 contain a stack-based buffer overflow vulnerability that could allow a remote attacker to cause a denial of service and potentially obtain sensitive information.
IBM i versions 7.6, 7.5, 7.4, and 7.3 contain an improper privilege management vulnerability that could allow a remote authenticated attacker to obtain unauthorized privileges.
IBM i versions 7.6, 7.5, 7.4, and 7.3 contain an untrusted search path vulnerability that could allow a remote authenticated attacker to execute arbitrary code.
IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 are vulnerable to arbitrary code execution on Windows when installed for all users due to a publicly writeable directory.
IBM Storage Scale versions 5.2.3.0 through 5.2.3.8 and 6.0.0.0 through 6.0.1.0 contain a hardcoded token in the GUI source code, used for inter-node cluster communication and REST API authentication between GUIs.
IBM Planning Analytics 2.0 and 2.1 Local is vulnerable to cross-site request forgery, which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
vantage6 version 5.0.2 and earlier has an algorithm-store edit permission lacking an ownership check, allowing one algorithm developer to alter another developer's algorithm while it is pending or under review. The attacker can change metadata including the algorithm image or image tag, causing reviewers and nodes to trust a different image from the one originally submitted. No fixed version is available as of this review.
SVGO (SVG Optimizer) is a Node.js library and CLI for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin (removeScriptElement in versions 1-3) can leave executable content in optimized SVGs because it does not remove namespaced or prefixed script elements such as <svg:script> and, in versions 3 and 4, matches JavaScript URIs case sensitively. Applications processing untrusted SVG input with this plugin enabled and serving the result can allow scripts to execute when another user opens the SVG, exposing local storage or cookies. Fixed in versions 2.8.3, 3.3.4, and 4.0.2.
phpList before 3.7.0-RC5 contains a CSRF vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unauthenticated GET request (?page=admins&delete=N) that is not protected by a CSRF token (the central verifyCsrfGetToken check uses enforce=false and is bypassed when the token parameter is absent). A remote attacker can trick a logged-in super-administrator into loading a crafted URL (e.g., embedded as an image in an email) to delete any non-self administrator account.