CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in Concrete5 version 5.7.3.1 allows attackers to manipulate database queries.
CSRF vulnerability in the Google Analyticator WordPress Plugin before version 6.4.9.3 rev @1183563 allows attackers to perform unauthorized actions on behalf of users.
CVE-2015-4619 describes a CSRF vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75.
CVE-2015-4085 describes a directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before version 1.6.1.
The WordPress Tune Library plugin before version 1.5.5 has an SQL injection vulnerability.
The syscheck/seechanges.c file in OSSEC versions 2.7 through 2.8.1 on NIX systems contains a vulnerability that allows local users to execute arbitrary code as root.
CVE-2014-9565 describes a CSRF vulnerability in the firmware of IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch versions 3.4.0000 and earlier. An attacker could exploit this vulnerability to perform unauthorized actions on behalf of a logged-in user.
The DeleteBitBuffer function in bitbuffer.c in mp4tools aacplusenc 0.17.5 has a vulnerability that allows remote attackers to cause a denial of service via a crafted .wav file. This can lead to invalid memory writes, resulting in application crashes.
The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to cause a denial of service via the url parameter to plugin_googlemap2_proxy.php.
The OCaml compiler allows attackers to have unspecified impact via unknown vectors, a similar issue to CVE-2017-9772 but with much less impact.
The kamcmd administrative utility and default configuration in kamailio before version 4.3.0 use the /tmp/kamailio_ctl directory.
A double free vulnerability in the gdImagePngPtr function in libgd2 before version 2.2.5 allows remote attackers to cause a denial of service via vectors related to a palette with no colors.
The T&W WIFI Repeater BE126 allows remote authenticated users to execute arbitrary code via shell metacharacters in the user parameter to cgi-bin/webupg.
The CSRF vulnerability in NexusPHP 1.5 allows remote attackers to hijack user authentication for specific requests, such as sending manas or adding administrators.
A CSRF vulnerability in Mongoose Web Server before version 6.9 allows remote attackers to hijack user authentication for requests modifying Mongoose.conf via a request to __mg_admin?save. This issue can be leveraged to execute arbitrary code remotely.
The identity zones feature in Pivotal Cloud Foundry and UAA allows remote authenticated users with privileges in one zone to gain privileges and perform operations in a different zone. The issue affects versions 208 through 229 and 2.0.0 through 2.7.3 and 3.0.0 UAA.
Apache Directory LDAP API before version 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors.
In the mxf_read_primer_pack function in libavformat/mxfdec.c in FFmpeg 3.3.3 to 2.4, an integer signedness error might occur when a crafted file with a large 'item_num' field, such as 0xffffffff, is provided. As a result, the variable 'item_num' turns negative, bypassing the check for a large value.
ldapauth-fork before 2.3.3 allows remote attackers to perform LDAP injection attacks via a crafted username.
A race condition in SuiteCRM before version 7.2.3 allows remote attackers to execute arbitrary code. This vulnerability exists due to an incomplete fix for CVE-2015-5947.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS