CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The vulnerability in Module::Signature before version 0.75 allows local users to gain privileges via a malicious module in the current working directory.
Module::Signature before 0.74 allows remote attackers to execute arbitrary shell commands via a crafted SIGNATURE file which is not properly handled when generating checksums from a signed manifest.
CVE-2015-1846 in unzoo allows remote attackers to cause a denial of service through unspecified vectors, leading to an infinite loop and resource consumption. The issue affects the ExtrArch and ListArch functions related to pointer handling.
Buffer overflow in the EntrReadArch function in unzoo might allow remote attackers to execute arbitrary code via unspecified vectors.
Docker Engine before version 1.6.1 uses weak permissions for several system directories, allowing local users to modify the host and obtain sensitive information.
Libcontainer version 1.6.0, used in Docker Engine, allows local users to escape containerization via a symlink attack, enabling them to write to arbitrary files on the host system when respawning a container.
Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, allowing local users to gain privileges via a symlink attack.
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
The vulnerability in GNS3 1.2.3 related to an untrusted search path allows local users to gain privileges via a malicious uuid.dll file in an unspecified directory.
The label decompression functionality in PowerDNS Recursor in versions 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2, as well as in the Authoritative Server in versions 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4, allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself.
libuv before 0.10.34 does not properly drop group privileges, allowing context-dependent attackers to gain privileges via unspecified vectors.
The InFocus IN3128HD projector with firmware 0.26 does not restrict access to cgi-bin/webctrl.cgi.elf, allowing remote attackers to modify the DHCP server and device IP configuration, reboot the device, and change the device name.
The InFocus IN3128HD projector with firmware 0.26 allows remote attackers to bypass authentication via a direct request to main.html.
Integer overflow in the HwpApp::CHncSDS_Manager function in Hancom Office HanWord allows remote attackers to cause a denial of service (crash) and possibly influence the program's execution flow via a document with a large paragraph size, leading to heap corruption.
The WP Symposium plugin before version 15.4 for WordPress contains an SQL injection vulnerability in forum.php that allows remote attackers to execute arbitrary SQL commands via the show parameter in the QUERY_STRING.
Multiple unquoted Windows search path vulnerabilities in McAfee ePO Deep Command 2.1 and 2.2 before HF 1058831 allow local users to gain privileges via unspecified vectors.
A vulnerability in Quassel before version 0.12.2 is due to improper re-initialization of the database session after a PostgreSQL restart. This allows a remote attacker to perform SQL injection by sending a message containing a backslash character. This is an incomplete fix for CVE-2013-4422.
An XML external entity (XXE) vulnerability in the RPC interface in Spacewalk and Red Hat Network (RHN) Satellite 5.7 and earlier allows remote attackers to read arbitrary files and possibly have other unspecified impact.
Multiple SQL injection vulnerabilities in ClipBucket 2.6 Revision 738 and earlier allow remote attackers to execute arbitrary SQL commands via various parameters in ajax.php and other scripts.
Buffer overflow in the XML parser in Mozilla Firefox before version 38.0, Firefox ESR 31.x before version 31.7, and Thunderbird before version 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data.