CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The library www_browser.pl in SWI-Prolog 7.2.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
In lib/webbrowser.py in Python through version 3.6.3, strings are not validated before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
The uiutil.c file in FontForge through version 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which may allow remote attackers to conduct argument-injection attacks via a crafted URL.
The url_handler.pl tool in TIN version 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which may allow remote attackers to conduct argument-injection attacks via a crafted URL.
In version 2.6 of OCaml Batteries Included (ocaml-batteries), the batteriesConfig.mlp component does not validate strings before launching the program specified by the BROWSER environment variable, which may allow remote attackers to conduct argument-injection attacks via a crafted URL.
In version 0.30.10 of White_dune, strings are not validated before launching the program specified by the BROWSER environment variable, which may allow remote attackers to conduct argument-injection attacks via a crafted URL.
In libsylph/utils.c in Sylpheed through version 3.6, strings are not validated before launching the program specified by the BROWSER environment variable, which may allow remote attackers to conduct argument-injection attacks via a crafted URL.
In version 1.19.0 of Reddit Terminal Viewer (RTV), the script scripts/inspect_webbrowser.py does not validate strings before launching the program specified by the BROWSER environment variable, which may allow remote attackers to conduct argument-injection attacks via a crafted URL.
In version 4.7.3 of Metview, the etc/ObjectList component does not validate strings before launching the program specified by the BROWSER environment variable, which may allow remote attackers to conduct argument-injection attacks via a crafted URL.
In version 8.4.0 of nip2, the boxes.c file does not validate strings before launching the program specified by the BROWSER environment variable, which may allow remote attackers to conduct argument-injection attacks via a crafted URL.
TeX Live through version 20170524 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
KildClient version 3.1.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
In Apache Fineract versions 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with appropriate permissions can inject malicious SQL into SELECT queries. The 'sqlSearch' parameter on several endpoints is not sanitized and is directly appended to the query.
Podatność w Panda Global Protection 17.0.1 umożliwia wywołanie awarii systemu poprzez wysłanie specjalnie spreparowanego żądania DeviceIoControl do sterownika \.\PSMEMDriver z kodem 0xb3702c04.
Podatność w Panda Global Protection 17.0.1 umożliwia wywołanie awarii systemu poprzez wysłanie specjalnie spreparowanego żądania DeviceIoControl do sterownika \.\PSMEMDriver z kodem 0xb3702c44.
CVE-2017-7738 is an Information Disclosure vulnerability in Fortinet FortiOS versions 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, and 5.2 and below, allowing an admin user with super_admin privileges to view current SSL VPN web portal session info, which may contain user credentials.
In Octopus Deploy before version 4.1.3, the machine update process doesn't check that the user has access to all environments. This allows an access-control bypass because the set of environments to which a machine is scoped may include environments in which the user lacks access.
IBM Tivoli Monitoring V6 6.2.2.x contains a vulnerability that could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free error. An attacker could exploit this vulnerability to execute arbitrary code or cause the application to crash.
Vulnerability in MikroTik RouterBOARD versions v6.39.2 and v6.40.5 allows an unauthenticated remote attacker to cause a denial of service (DoS) by connecting to TCP port 53 and sending data starting with many null ('\0') characters. The issue is likely related to DNS handling.
Facebook Clone Script version 1.0 has a SQL Injection vulnerability via the id parameter in the friend-profile.php file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS