CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unit4 Polska TETA Web version 22.62.3.4 does not properly restrict access to the (1) Design Mode and (2) Debug Logger mode modules, allowing remote attackers to gain privileges via crafted 'received parameters.'
Checkmarx CxSAST (formerly CxSuite) before 7.1.8 allows remote authenticated users to bypass the CxQL sandbox protection mechanism and execute arbitrary C# code by asserting the (1) System.Security.Permissions.PermissionState.Unrestricted or (2) System.Security.Permissions.SecurityPermissionFlag.AllFlags permission.
The WP Limit Login Attempts plugin before version 2.0.1 has multiple SQL injection vulnerabilities in the getip function. Remote attackers can execute arbitrary SQL commands via the X-Forwarded-For or Client-IP HTTP headers.
A stack-based buffer overflow in the ASUS TM-AC1900 router allows remote attackers to execute arbitrary code via crafted HTTP header values.
Multiple stack-based buffer overflows in the Reprise License Manager service in Borland AccuRev allow remote attackers to execute arbitrary code via the akey, actserver parameter to the activate_doit function, or licfile parameter to the service_startup_doit functionality.
The IBS Mappro plugin for WordPress before version 1.0 contains an absolute path traversal vulnerability in lib/download.php, allowing remote attackers to read arbitrary files by providing a full pathname in the file parameter.
A stack-based buffer overflow exists in the Administration Server of IBM HTTP Server affecting versions 6.1.0.x through 6.1.0.47, 7.0.0.x before 7.0.0.39, 8.0.0.x before 8.0.0.12, and 8.5.x before 8.5.5.7. This allows remote authenticated users to execute arbitrary code.
A vulnerability in IBM WebSphere Portal allows remote attackers to cause a denial of service through a crafted request, leading to CPU and memory consumption.
The vulnerability in Impero Education Pro before version 5105 relies on the fixed string '-1|AUTHENTICATE\x02PASSWORD' for authentication. A remote attacker can exploit this weakness to execute arbitrary programs via an encrypted command.
Impero Education Pro before version 5105 uses a hardcoded CBC key and initialization vector derived from a hash of the Imp3ro string. This makes it easier for remote attackers to obtain plaintext data by sniffing the network for ciphertext data.
Util.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.15, 4.3.x and 4.4.x before 4.4.10, and 5.x before 5.0.1 mishandles long e-mail addresses during account registration. This allows remote attackers to obtain the default privileges for an arbitrary domain name by placing that name in a substring of an address.
Multiple stack-based buffer overflows in Yahoo! Messenger 11.5.0.228 and earlier allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the (1) shortcut or (2) title keys in an emoticons.xml file.
CVE-2015-6915 is an SQL injection vulnerability in ResourceSpace version 7.3.7009 and earlier, allowing remote attackers to execute arbitrary SQL commands via the 'user' cookie in feedback.php.
CVE-2015-6914 in SiteFactory CMS 5.5.9 allows remote attackers to read arbitrary files via a full pathname in the file parameter to assets/download.aspx.
Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharacters in the subtitle_codepage parameter to subtitle.cgi.
CVE-2015-6911 in Synology Video Station before version 1.5-0763 contains an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the id parameter in watchstatus.cgi.
CVE-2015-6910 is an SQL injection vulnerability in Synology Video Station before version 1.5-0757 that allows remote attackers to execute arbitrary SQL commands via the id parameter to audiotrack.cgi.
The administrative web interface on Moxa EDS-405A and EDS-408A switches with firmware before 3.6 allows remote authenticated users to bypass a read-only protection mechanism by using Firefox with a web-developer plugin.
SMA Solar Sunny WebBox has hardcoded passwords, which makes it easier for remote attackers to obtain access via unspecified vectors.
Multiple stack-based buffer overflows in unspecified DLL files in Advantech WebAccess before version 8.0.1 allow remote attackers to execute arbitrary code via unknown vectors.