CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in Piwigo before 2.5.6, 2.6.x before 2.6.5, and 2.7.x before 2.7.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Multiple SQL injection vulnerabilities in Sefrengo before version 1.6.2 allow remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to backend/main.php or via the value_id parameter in a save_value action to backend/main.php.
CVE-2015-1405 is an SQL injection vulnerability in the Content Rating Extbase extension version 2.0.3 and earlier for TYPO3, allowing remote attackers to execute arbitrary SQL commands.
SQL injection vulnerability in the Content Rating extension 1.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
SQL injection vulnerability in search.php in NPDS Revolution 13 allows remote attackers to execute arbitrary SQL commands via the query parameter.
CVE-2015-1348 involves a heap-based buffer overflow in Aruba Instant (IAP) devices with firmware before version 4.0.0.7 and 4.1.x before version 4.1.1.2. This allows remote attackers to cause a denial of service (crash or reset to factory default) via a malformed frame to the wireless interface.
The bdisk.sys driver in COMODO Backup before version 4.4.1.23 allows remote attackers to gain privileges via a crafted device handle, leading to a NULL pointer dereference.
Directory traversal vulnerability in install.php in FluxBB before 1.5.8 allows remote attackers to include and execute arbitrary local install.php files via a .. (dot dot) in the install_lang parameter.
ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upack packer file, related to a 'heap out of bounds condition.'
Pexip Infinity before version 8 uses the same SSH host keys across different customers' installations, allowing man-in-the-middle attackers to spoof Management and Conferencing Nodes.
Blue Coat ProxyClient versions before 3.3.3.3 and 3.4.x before 3.4.4.10 and Unified Agent before 4.1.3.151952 do not properly validate certain certificates. This allows man-in-the-middle attackers to spoof ProxySG Client Managers, enabling them to modify configurations and execute arbitrary software updates.
The CAPWAP daemon in Fortinet FortiOS 5.0 Patch 7 build 4457 is vulnerable to an attack that can lead to denial of service by sending a large number of ClientHello DTLS messages from remote attackers.
The sctp module in FreeBSD 10.1 before p5, 10.0 before p17, 9.3 before p9, and 8.4 before p23 allows remote attackers to cause a denial of service (NULL pointer dereference and kernel panic) via a crafted RE_CONFIG chunk.
An integer signedness error in the vt console driver in FreeBSD 9.3 before p10 and 10.1 before p6 allows local users to cause a denial of service (crash) and possibly gain privileges via a negative value in a VT_WAITACTIVE ioctl call, triggering an array index error and out-of-bounds kernel memory access.
SQL injection vulnerability in Restaurant Biller allows remote attackers to execute arbitrary SQL commands via the cid parameter in a category action to index.php.
Buffer overflow in the integrated web server on Siemens Ruggedcom WIN51xx, WIN52xx, WIN70xx, and WIN72xx devices with specified firmware versions allows remote attackers to execute arbitrary code.
The integrated management service on Siemens Ruggedcom WIN51xx, WIN52xx, WIN70xx, and WIN72xx devices with specified firmware versions allows remote attackers to bypass authentication and perform administrative actions.
IBM Tivoli Monitoring (ITM) versions 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP09, 6.2.3 through FP05, and 6.3.0 before FP04 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands by leveraging Take Action view authority to modify in-progress commands.
I-O DATA DEVICE NP-BBRM routers allow remote attackers to cause a denial of service (SSDP reflection) via UPnP requests.
CVE-2015-0868 describes an unrestricted file upload vulnerability in Mrs. Shiromuku Perl CGI shiromuku(bu2)BBS before version 2.91, allowing remote attackers to execute arbitrary code by uploading an executable file.