CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Reporting and Monitoring component in IBM Tivoli Storage Manager 6.3 before 6.3.6 and 7.1 before 7.1.3 on Linux and AIX uses world-writable permissions for unspecified files, allowing local users to gain privileges by writing to a file.
A vulnerability in mediaserver in Android 4.4 and 5.1 before version 5.1.1 LMY48X allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
A vulnerability in mediaserver in Android 4.4 through 5.x before version 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
Versions of Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 contain a vulnerability in libmedia that allows attackers to gain privileges via a crafted application.
The vulnerability in libstagefright in Android before version 5.1.1 LMY48X and 6.0 before November 1, 2015, allows attackers to gain privileges or cause a denial of service (memory corruption) via a crafted application.
The libutils library in Android before version 5.1.1 LMY48X and 6.0 before November 1, 2015, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file.
Versions of Android 5.x before 5.1.1 LMY48X and 6.0 before 2015-11-01 contain a vulnerability in mediaserver that allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.
The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself.
The wp-championship plugin version 5.8 for WordPress contains multiple SQL injection vulnerabilities in the cs_admin_users.php file, allowing remote attackers to execute arbitrary SQL commands.
Qolsys IQ Panel (also known as QOL) before version 1.5.1 does not verify the digital signatures of software updates, allowing man-in-the-middle attackers to bypass intended access restrictions via a modified update.
Qolsys IQ Panel (aka QOL) before version 1.5.1 has hardcoded cryptographic keys, allowing remote attackers to create digital signatures for code by leveraging knowledge of a key from a different installation.
The mod_l2_entry function in arch/x86/mm.c in Xen 3.4 through 4.6.x does not properly validate level 2 page table entries, allowing local PV guest administrators to gain privileges via a crafted superpage mapping.
SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
In Joomla! 3.2 before version 3.4.5, there is an SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.php. This allows remote attackers to execute arbitrary SQL commands via the list[select] parameter to index.php.
Joomla! versions 3.2 before 3.4.4 have an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
389 Directory Server (formerly Fedora Directory Server) before version 1.3.3.12 does not enforce the nsSSL3Ciphers preference when creating an sslSocket, allowing remote attackers to use a disabled cipher.
The AddUserFinding implementation in Medicomp MEDCIN Engine versions before 2.22.20153.226 may allow remote attackers to execute arbitrary code or cause a denial of service via a crafted packet on port 8190.
SQL injection vulnerability in Techno Project Japan Enisys Gw before version 1.4.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Buffer overflow in IBM Domino versions 8.5.1 through 8.5.3 before 8.5.3 FP6 IF10 and 9.x before 9.0.1 FP4 IF3 allows remote attackers to execute arbitrary code or cause a denial of service (SMTP daemon crash) via a crafted GIF image.
Buffer overflow in IBM Domino versions 8.5.1 through 8.5.3 before 8.5.3 FP6 IF10 and 9.x before 9.0.1 FP4 IF3 allows remote attackers to execute arbitrary code or cause a denial of service (SMTP daemon crash) via a crafted GIF image.