CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
MyBB before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows might allow remote attackers to obtain sensitive information from ACP backups via vectors involving a short name.
The fetch_remote_file function in MyBB before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.
MyBB before version 1.8.8 on Windows and MyBB Merge System before version 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via vectors related to 'style import.'
MyBB before version 1.8.7 and MyBB Merge System before version 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directory listing protection in upload directories.
MyBB (also known as MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors involving templates.
Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image.
A heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before version 1.13 allows remote attackers to exploit it via a crafted BMP image.
A heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before version 1.13 allows remote attackers to exploit it via a crafted BMP image.
Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to exploit a crafted BMP image.
Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to exploit this via a crafted BMP image.
Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to exploit it via a crafted BMP image.
The bm_new function in bitmap.h in potrace 1.13 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure.
MyBB before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files.
The xmlhttp.php file in MyBB before version 1.6.18 and 1.8.x before 1.8.6, as well as MyBB Merge System before 1.8.6, contains a vulnerability that allows remote attackers to bypass intended access restrictions related to the forum password.
The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.
An undisclosed traffic pattern received by a BIG-IP Virtual Server with TCP Fast Open enabled may cause the Traffic Management Microkernel (TMM) to restart, resulting in a Denial-of-Service (DoS).
The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism.
The handle_certificate function in Trend Micro Virtual Mobile Infrastructure before version 5.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the password.
Trend Micro Smart Protection Server versions 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allow local web server users to execute arbitrary code with root privileges via a Trojan horse .war file in the Solr webapps directory.
SnmpUtils in Trend Micro Smart Protection Server before specified builds allows remote authenticated users to execute arbitrary commands via shell metacharacters in the admin_notification.php parameters.