CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2014-10020 is a SQL injection vulnerability in login.php in Simple e-document 1.31 that allows remote attackers to execute arbitrary SQL commands via the username parameter.
The Welcart e-Commerce plugin version 1.3.12 for WordPress contains multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. The attack can be carried out through the changeSort or switch parameters on the usces_itemedit page.
CVE-2014-10015 is an SQL injection vulnerability in load-calendar.php in PHPJabbers Event Booking Calendar 2.0 that allows remote attackers to execute arbitrary SQL commands via the cid parameter.
The Another WordPress Classifieds Plugin for WordPress has an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the keywordphrase parameter in a dosearch action.
A stack-based buffer overflow in UltraCamLib in the UltraCam ActiveX Control (UltraCamX.ocx) for the TRENDnet SecurView camera TV-IP422WN allows remote attackers to execute arbitrary code.
CVE-2014-10004 is an SQL injection vulnerability in admin/data_files/move.php in Maian Uploader 4.0 that allows remote attackers to execute arbitrary SQL commands via the id parameter.
Wielokrotne podatności typu cross-site request forgery (CSRF) w routerze D-Link DIR-600 (rev. Bx) z oprogramowaniem układowym przed wersją 2.17b02 umożliwiają zdalnym atakującym przejęcie autoryzacji administratorów dla różnych żądań, takich jak tworzenie konta administratora czy włączanie zdalnego zarządzania.
The YourMembers plugin for WordPress has an SQL injection vulnerability in includes/ym-download_functions.include.php, allowing remote attackers to execute arbitrary SQL commands via the ym_download_id parameter.
The RealNetworks GameHouse RealArcade Installer (also known as ActiveMARK Game Installer) versions 2.6.0.481 and 3.0.7 has weak permissions for the GameHouse Games directory, allowing local users to gain privileges via a Trojan horse DLL in an individual game's directory.
The RACInstaller.StateCtrl.1 ActiveX control in InstallerDlg.dll in RealNetworks GameHouse RealArcade Installer 2.6.0.481 performs unexpected type conversions for invalid parameter types, allowing remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted arguments.
Buffer overflow in Hancom Office 2010 SE allows remote attackers to execute arbitrary code via a long string in the Text attribute in a TEXTART XML element in an HML file.
The GD Star Rating plugin version 19.22 for WordPress has an SQL injection vulnerability that allows remote administrators to execute arbitrary SQL commands via the s parameter on the gd-star-rating-stats page in wp-admin/admin.php.
Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before 1.6.16 may allow context-dependent attackers to execute arbitrary code via a 'very wide interlaced' PNG image on 64-bit systems.
A stack-based buffer overflow in Schneider Electric Wonderware InTouch Access Anywhere Server versions 10.6 and 11.0 allows remote attackers to execute arbitrary code via a request for a filename that does not exist.
Multiple directory traversal vulnerabilities in the file-upload feature in IBM PureApplication System and Workload Deployer allow remote authenticated users to execute arbitrary code.
The ASUS WRT firmware versions 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and others, used in RT-AC66U, RT-N66U, and other routers, have an issue with improper MAC address checking in requests. This allows remote attackers to bypass authentication and execute arbitrary commands via a NET_CMD_ID_MANU_CMD packet to UDP port 9999.
Multiple SQL injection vulnerabilities in the administrative backend in Sefrengo before version 1.6.1 allow remote administrators to execute arbitrary SQL commands via the (1) idcat or (2) idclient parameter to backend/main.php.
The AJAX Post Search (cardoza-ajax-search) plugin before version 1.3 for WordPress contains an SQL injection vulnerability in the 'the_search_function'. Remote attackers can execute arbitrary SQL commands via the srch_txt parameter in a 'the_search_text' action to wp-admin/admin-ajax.php.
The CformsII plugin version 14.7 and earlier for WordPress has an unrestricted file upload vulnerability that allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
Use-after-free vulnerability in Xen 4.2.x, 4.3.x, and 4.4.x allows remote domains to cause a denial of service (system crash) via a crafted hypercall during HVM guest teardown.