CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.19)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Formie, a Craft CMS plugin for creating forms, before version 3.1.27 passes request-derived Hidden field defaults (e.g., User Agent, URL, query parameters) to Craft's Twig rendering layer. An unauthenticated attacker can place Twig syntax in these values, leading to server-side template evaluation (SSTI), potentially resulting in information disclosure, application state modification, or remote code execution.
SSHFS before version 3.7.6 contains a vulnerability where a rogue SFTP server can return arbitrary symlink targets (absolute or with parent-directory components). SSHFS passes them to the kernel via FUSE, and the transform_symlinks mitigation does not block relative paths. A victim or tool (e.g., cp, rsync, editor) following such a link can disclose local files to the server or write server-controlled content to local files.
MyBooks (Talebook) in version 3.41.2 and earlier contains a vulnerability in the handling of SOCIAL_AUTH key names in the AdminSettings.post handler. These names are concatenated without proper escaping into the auto.py file, allowing an administrator to inject arbitrary Python code. The code is executed during module import, enabling command execution with service privileges.
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to gain root privileges due to improper authentication.
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to bypass security restrictions due to the exposure of intermediate certificate authority private keys in a publicly available update file.
stigmem-node contains an insecure default configuration that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation traffic to cleartext interception and man-in-the-middle attacks.
stigmem versions before 0.9.0a2 allow unauthenticated access when authentication is disabled on non-loopback deployments. Attackers can perform read, write, and federation operations with anonymous identity when nodes are exposed outside local development environments.
stigmem-node 0.9.0a1 accepts federation peer key material during peer registration without a separate administrator out-of-band fingerprint approval step. On nodes that accept federation peer registration over a network where initial registration can be intercepted or misdirected, an attacker can register a malicious peer and gain access to or tamper with federation traffic. Fixed in 0.9.0a2, which introduces a pending approval flow requiring administrator fingerprint verification before peer tokens are accepted.
Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64. The filter_type request value is interpolated into the query as a.type = "..." and the type_filter array as a.type IN ("..."), with no quoting or escaping.
Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64. The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group.
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Faydam Innovation Inc. FAYDAM Datalogger allows SQL Injection. This issue affects FAYDAM Datalogger: from 2.7.1 before 2.8.0.
Unauthenticated SQL Injection in Total Donations <= 2.0.5 versions.
Unauthenticated Privilege Escalation in Total Donations <= 2.0.5 versions.
Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions.
Unauthenticated SQL Injection in Nikstore Core <= 1.5 versions.
PHP Object Injection vulnerability in Flexible Subscriptions plugin versions up to and including 1.8.1. Allows an attacker to inject malicious PHP objects, potentially leading to unauthorized access or code execution.
Unauthenticated privilege escalation vulnerability in TrueBooker versions up to and including 1.2.6. An attacker without logging in can elevate privileges, e.g., to administrator level.
SQL Injection vulnerability in NGG Smart Image Search plugin versions prior to 4.0.0. An unauthenticated attacker can inject SQL queries, potentially leading to unauthorized database access.