CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in the XML parser in Foundation in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted XML document.
FontParser in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted .dfont file.
Directory traversal vulnerability in afc in AppleFileConduit in iOS before 8.1.3 and Apple TV before 7.0.3 allows attackers to access unintended filesystem locations by creating a symlink.
The Network-Based Application Recognition (NBAR) protocol implementation in Cisco IOS 15.3(100)M and earlier on Cisco 2900 Integrated Services Router devices allows remote attackers to cause a denial of service (NBAR process hang) via IPv4 packets.
The XML parser in Cisco Prime Service Catalog before version 10.1 allows remote authenticated users to read arbitrary files or cause a denial of service through an external entity declaration in conjunction with an entity reference. This issue is related to an XML External Entity (XXE) vulnerability.
A double free vulnerability exists in Adobe Flash Player before 13.0.0.264 and 14.x through 16.x before 16.0.0.296 on Windows and OS X and before 11.2.202.440 on Linux. It allows attackers to execute arbitrary code via unspecified vectors.
Buffer overflow in the Data Transfer Program in IBM i Access 5770-XE1 versions 5R4, 6.1, and 7.1 on Windows allows local users to gain privileges via unspecified vectors.
CVE-2015-0235 involves a heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc in versions 2.2 and other 2.x versions before 2.18. This allows attackers to execute arbitrary code via the gethostbyname or gethostbyname2 functions.
The Pixabay Images plugin before version 2.4 for WordPress does not properly restrict access to the upload functionality, allowing remote attackers to write to arbitrary files.
The asn1_get_sequence_of function in the PolarSSL library from version 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a pointer in the asn1_sequence linked list, which may lead to a denial of service (crash) or potentially execute arbitrary code via a crafted ASN.1 sequence in a certificate.
The Gst.MapInfo function in Vala 0.26.0 and 0.26.1 uses an incorrect buffer length declaration for the Gstreamer bindings, allowing context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors, triggering a heap-based buffer overflow.
SQL injection vulnerability in ferretCMS 1.0.4-alpha allows remote attackers to execute arbitrary SQL commands via the p parameter in an update action to admin.php.
The unrestricted file upload vulnerability in ferretCMS version 1.0.4-alpha allows remote administrators to execute arbitrary code by uploading a file with an executable extension and then accessing it via a direct request.
SQL injection vulnerability in Sequelize before version 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the order parameter.
CVE-2015-1367 is an SQL injection vulnerability in CatBot 0.4.2's index.php that allows remote attackers to execute arbitrary SQL commands via the lastcatbot parameter.
CVE-2015-1364 is an SQL injection vulnerability in the getProfile function in system/profile.functions.php in Free Reprintables ArticleFR 3.0.5. It allows remote attackers to execute arbitrary SQL commands via the username parameter to register.
Buffer overflow in the Customize 35mm tab in Two Pilots Exif Pilot 4.7.2 allows remote attackers to execute arbitrary code via a long string in the maker element in an XML file.
Skia in Google Chrome before version 40.0.2214.91 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data that is improperly handled during text drawing.
Use-after-free vulnerability in the process_nested_data function in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys within the serialized properties of an object.
The FTP server on the Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware through 1.60 IR 04 has hardcoded credentials, which makes it easier for remote attackers to obtain access via an FTP session.