CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.join(tempDir.name, fileName) without reducing it to a base name. A filename containing ../ can escape the temporary directory because path.basename() normalization is missing and write the supplied document buffer to an arbitrary path writable by the process, including an SSH authorized_keys file, a cron configuration, or a web root.
Silverstripe UserForms, from 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, has a vulnerability in the email recipient subject field. A specially crafted payload can be interpreted as executable server-side code. An authenticated CMS user with permission to configure a UserForms email recipient can run arbitrary code on the server, compromising confidentiality, integrity, and availability. Fixed in versions 6.4.9, 7.0.7, and 7.1.1.
Silverstripe Advanced Workflow, prior to 6.4.5, 7.1.3, and 7.2.1, has a vulnerability in the email template module. An attacker with permission to author email templates can place a specially crafted payload in NotifyUsersWorkflowAction.EmailTemplate, leading to PHP evaluation and arbitrary code execution on the server. Fixed in versions 6.4.5, 7.1.3, and 7.2.1.
CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influence job parameters can submit semantically different data that produces the same identifier, resulting in legitimate jobs dropped as duplicate collisions. Fixed in version 2.3.1.
n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the db_path database file path as a node parameter that permits data expressions from upstream workflow input. A workflow author who maps untrusted input to db_path can allow a remote attacker to select which SQLite file the n8n process opens, enabling traversal outside the intended database location and potentially reading, creating, or overwriting files accessible to the process.
Trilium, prior to version 0.104.0, has a vulnerability in the automatic image-download feature. It accepts file:// URLs in img tags and reads the referenced local file with no path validation, allowing any authenticated user to disclose arbitrary files readable by the Trilium process. Additionally, pointing at an unbounded source like /dev/zero causes uncontrolled memory allocation and crashes the server. Fixed in version 0.104.0.
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an attacker-supplied import archive to embed a payload that executes as script. A book note's content is routed through the same rendering path as text notes and injected into the page with jQuery's html method when the note is shown as a grid-view preview card, so a malicious note survives Safe import and runs as soon as the victim opens the containing note. On the desktop client the Electron renderer runs with Node integration enabled, so the injected JavaScript escalates from cross-site scripting to full remote code execution on the victim's machine. This issue is fixed in version 0.104.0.
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the mindMap note type, whose JSON content is stored without sanitization, allowing an attacker-supplied import archive to embed a payload that renders as arbitrary HTML. A mind map node can carry a dangerouslySetInnerHTML property that the Mind Elixir library assigns directly to a node's innerHTML, so a malicious note survives Safe import and executes script as soon as the victim opens the imported mind map. On the desktop client the Electron renderer runs with Node integration enabled, so the injected JavaScript escalates from cross-site scripting to full remote code execution on the victim's machine. This issue is fixed in version 0.104.0.
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize note titles, and the GeoMap note view interpolates a marker note's title into raw HTML that is rendered as innerHTML, allowing an attacker-supplied import archive to inject script that runs when the map is displayed. Because Safe import neutralizes scripts but never escapes titles, a note whose title contains an HTML event-handler payload survives the import and executes as soon as the victim opens the GeoMap that renders its marker. On the desktop client the Electron renderer runs with Node integration enabled, so the injected JavaScript escalates from cross-site scripting to full remote code execution on the victim's machine. This issue is fixed in version 0.104.0.
Trilium, prior to version 0.104.0, has a vulnerability in the default-on "Safe import" filter. The filter fails to neutralize the shareTemplate relation because it is not marked as dangerous, allowing an attacker-supplied import archive to plant a server-side template leading to remote code execution. When the victim publishes the imported note, the public share renderer feeds the linked EJS code note's raw bytes into ejs.render, which compiles them in the server's Node process. Fixed in version 0.104.0.
An integer overflow in the SMF component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted GTP packet.
Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configured SMTP server on the application via making a POST request to the endpoint with needed parameters and header.
Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php.
Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'rename' permission to take over the super administrator account via a specially crafted POST request to the affected endpoint renaming the application configuration file and triggering a rebuild of configuration and resetting super administrator credentials to default values.
Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint.
Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to know in which system directory the application code is running by sending a GET request to the endpoint.
The vulnerability allows arbitrary file write in Veno File Manager 4.4.9. An authenticated user with super administrator role can overwrite any PHP file in the application via a specially crafted POST request to the translations endpoint.
The access control vulnerability in Veno File Manager 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request to save-cvs.php.
The path traversal vulnerability in Veno File Manager 4.4.9 allows arbitrary file read. An authenticated attacker with super administrator role can disclose sensitive information via two specially crafted HTTP requests (POST and GET) to index.php and streamvid.php endpoints.
Veno File Manager 4.4.9 is vulnerable to arbitrary file deletion in the translations endpoint. An attacker can delete any file in the application by using the 'remove' parameter in the request.