CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in the Novalnet Payment Module Ubercart module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
The Storage API module 7.x-1.x before 7.x-1.8 for Drupal does not properly restrict access to Storage API fields attached to entities that are not nodes, allowing remote attackers to have unspecified impact via unknown vectors.
The Hostmaster (Aegir) module 6.x-2.x before 6.x-2.4 and 7.x-3.x before 7.x-3.0-beta2 for Drupal allows remote attackers to execute arbitrary PHP code via a crafted file in the directory used to write Apache vhost files for hosted sites in a multi-site environment.
SQL injection vulnerability in pimcore before build 3473 allows remote attackers to execute arbitrary SQL commands via the filter parameter to admin/asset/grid-proxy.
Multiple SQL injection vulnerabilities in the J2Store (com_j2store) extension before version 3.1.7 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) sortby or (2) manufacturer_ids[] parameter to index.php.
The Powerplay Gallery plugin version 3.3 for WordPress has an unrestricted file upload vulnerability that allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
The Powerplay Gallery plugin version 3.3 for WordPress contains multiple SQL injection vulnerabilities in upload.php that allow remote attackers to execute arbitrary SQL commands via the (1) albumid or (2) name parameter.
The Install Framework Legacy component in Apple OS X before version 10.10.5 has a vulnerability that does not properly drop privileges, allowing attackers to execute arbitrary code in a privileged context via a crafted app.
IOGraphics in Apple OS X before 10.10.5 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app.
QuickTime 7 in Apple OS X before version 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted file.
Libinfo in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by leveraging use of an AF_INET6 socket.
FontParser in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted font file.
Buffer overflow in IOHIDFamily in Apple iOS before 8.4.1 and OS X before 10.10.5 allows local users to gain privileges via unspecified vectors.
The MSVDX driver in Apple iOS before 8.4.1 allows remote attackers to cause a denial of service (device crash) via a crafted video.
A vulnerability in the NTFS file system in Apple OS X before version 10.10.5 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
libpthread in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via an app that uses a crafted syscall to interfere with locking.
A race condition in the Install.framework component in Apple OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context. This issue is due to incorrect privilege dropping associated with a locking error.
The Data Detectors Engine in Apple OS X before version 10.10.5 allows attackers to execute arbitrary code or cause a denial of service through a crafted series of Unicode characters.
Apple iOS versions before 8.4.1 and OS X versions before 10.10.5 allow local users to bypass a code-signing protection mechanism by appending code to a crafted executable file.
In Apple iOS before 8.4.1 and OS X before 10.10.5, local users can bypass a code-signing protection mechanism via a crafted Mach-O file.