CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Equation Editor in Microsoft Office 2007, 2010, 2013, and 2016 has a remote code execution vulnerability due to improper handling of objects in memory, aka 'Microsoft Office Memory Corruption Vulnerability'. This CVE is unique from CVE-2018-0797 and CVE-2018-0812.
Equation Editor in Microsoft Office 2007, 2010, 2013, and 2016 has a remote code execution vulnerability due to improper handling of objects in memory, aka 'Microsoft Office Memory Corruption Vulnerability'.
A door-unlocking issue was discovered on Software House iStar Ultra devices through version 6.5.2.20569 when used with the IP-ACM Ethernet Door Module. The communications between the IP-ACM and the iStar Ultra are encrypted using a fixed AES key and IV, leading to replay attacks and message forgery.
Red Lion HMI panels allow remote attackers to cause a denial of service (software exception) via an HTTP POST request to a long URI that does not exist.
In Wireshark before version 2.2.12, the MRDISC dissector misuses a NULL pointer, causing the program to crash. This issue was addressed by validating an IPv4 address.
The Biometric Shift Employee Management System has a CSRF vulnerability in index.php in the edit_holiday action.
PHP Scripts Mall Muslim Matrimonial Script allows arbitrary file upload via admin/mydetails_edit.php.
PHP Scripts Mall Muslim Matrimonial Script is vulnerable to SQL injection via the mem_id parameter in the view-profile.php file.
ZyXEL P-660HW v3 devices are vulnerable to a remote denial of service attack that can be executed by flooding the device with IP packets having a TTL of 1, leading to high CPU consumption.
The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, allowing attackers to bypass intended IP address access restrictions.
The TheCartPress eCommerce Shopping Cart plugin for WordPress before version 1.3.9.3 allows remote attackers to obtain sensitive order detail information by leveraging a 'broken authentication mechanism.'
The find_ifcfg_path function in netcf before version 0.2.7 may allow attackers to cause application crashes via augeas path expression vectors.
CVE-2014-0120 describes a CSRF vulnerability in the admin terminal of Hawt.io that allows remote attackers to hijack the authentication of arbitrary users to execute commands on the Karaf server.
In LibTIFF version 4.0.8, there is a heap-based use-after-free vulnerability in the t2p_writeproc function in tiff2pdf.c.
SQL injection vulnerability in the 'reorder' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter.
SQL injection vulnerability in the 'order' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id desc' parameter.
SQL injection vulnerability in the 'where' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id' parameter.
SQL injection vulnerability in the 'find_by' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter.
JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/qrcode, related to QR code generation.
The Direct Mail (direct_mail) extension before 3.1.2 for TYPO3 allows remote attackers to obtain sensitive information by leveraging improper checking of authentication codes.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS