CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Cloudera Manager 5.5 and earlier allows remote attackers to obtain sensitive information via a stderr.log or stdout.log value in the filename parameter to /cmf/process/<process_id>/logs.
Directory traversal vulnerability in diag.jsp file in CA Unified Infrastructure Management 8.4 SP1 and earlier allows remote attackers to read arbitrary files via unspecified vectors.
The sys_thrsigdivert function in the OpenBSD kernel 5.9 allows remote attackers to cause a denial of service (panic) by sending a negative 'ts.tv_sec' value.
CVE-2017-6411 affects D-Link DSL-2730U C1 IN_1.00 devices, allowing remote attackers to perform a Cross Site Request Forgery (CSRF) attack. Attackers can change DNS settings, firewall configuration, or any password.
An issue was discovered in sysPass 2.x before 2.1, related to the use of an algorithm that was never sufficiently reviewed by cryptographers. The use of the MCRYPT_RIJNDAEL_256() function instead of MCRYPT_RIJNDAEL_128 may allow an attacker to create unknown havoc in the remote system.
Multiple cross-site request forgery (CSRF) vulnerabilities on the D-Link DI-524 Wireless Router with firmware 9.01 allow remote attackers to change the admin password, reboot the device, or possibly have unspecified other impact via crafted requests to CGI programs.
The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph name, allowing remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file.
An issue was discovered in ImageMagick 6.9.7 that could lead to a NULL pointer dereference when processing a specially crafted psd file, resulting in a DoS attack.
The WePresent WiPG-1500 device with firmware 1.0.3.7 has a manufacturer account with a hardcoded username and password. Once DEBUG mode is enabled, an attacker can connect to the device using the telnet protocol and log in with the 'abarco' account.
Podatność w dnslookup.cgi na urządzeniach NETGEAR DGN2200 z firmware do wersji 10.0.0.50 pozwala zdalnym, uwierzytelnionym użytkownikom na wykonywanie dowolnych poleceń systemowych poprzez użycie metaznaków powłoki w polu host_name w żądaniu HTTP POST.
A SQL Injection vulnerability was discovered in dates_function.php in Admidio 3.2.5. The POST parameter dat_cat_id is concatenated into a SQL query without any input validation or sanitization.
The auto-update feature of Open Embedded Linux Entertainment Center (OpenELEC) versions 6.0.3, 7.0.1, and 8.0.4 does not use encrypted connections or signed updates. A man-in-the-middle attacker could manipulate the update packages to gain root access remotely.
In Wireshark versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an infinite loop in the NetScaler file parser triggered by a malformed capture file. This was addressed by validating record sizes.
In Wireshark versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a K12 file parser crash triggered by a malformed capture file. This was addressed by validating the relationships between lengths and offsets in the code.
In Wireshark versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an infinite loop in the RTMPT dissector triggered by packet injection or a malformed capture file. This was addressed by properly incrementing a certain sequence value.
In Wireshark versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a WSP infinite loop triggered by packet injection or a malformed capture file. This was addressed by validating the capability length in epan/dissectors/packet-wsp.c.
In Wireshark versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an IAX2 infinite loop triggered by packet injection or a malformed capture file. This was addressed by constraining packet lateness.
In Wireshark versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an LDSS dissector crash, triggered by packet injection or a malformed capture file. This was addressed by ensuring that memory is allocated for a certain data structure.
In Wireshark versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a NetScaler file parser crash triggered by a malformed capture file. This was addressed by validating the relationship between pages and records.
In Wireshark versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an infinite loop in the Netscaler file parser triggered by a malformed capture file. This was addressed by changing the restrictions on file size.