CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The ProjectSend (formerly cFTP) has an unrestricted file upload vulnerability in process-upload.php that allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension.
HumHub versions 0.10.0-rc.1 and earlier have an SQL injection vulnerability in the actionIndex function in ListController.php. This allows remote authenticated users to execute arbitrary SQL commands via the 'from' parameter to index.php.
In the Debian mime-support package before version 3.52-1+deb7u1, the run-mailcap tool allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.
An unrestricted file upload vulnerability exists in the InfiniteWP Admin Panel before version 2.4.4 in uploadScript.php. This allows remote attackers to execute arbitrary code by uploading a file with a double extension.
SQL injection vulnerability in the InfiniteWP Admin Panel before version 2.4.4 in execute.php allows remote attackers to execute arbitrary SQL commands via the historyID parameter.
An SQL injection vulnerability in the InfiniteWP Admin Panel before version 2.4.3 in login.php allows remote attackers to execute arbitrary SQL commands via the email parameter.
Directory traversal vulnerability in Sonatype Nexus OSS and Pro before version 2.11.1-01 allows remote attackers to read or write to arbitrary files via unspecified vectors.
CVE-2014-8084 in OSClass before version 3.4.3 has a directory traversal vulnerability that allows remote attackers to include and execute arbitrary local files.
SQL injection vulnerability in the Search::setJsonAlert method in OSClass before version 3.4.3 allows remote attackers to execute arbitrary SQL commands via the alert parameter in a search alert subscription action.
The frontend rendering component in TYPO3 versions 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set to 'all' or 'cached', allows remote attackers to conduct a 'Cache Poisoning' attack using a URL with arbitrary arguments, potentially leading to unspecified impact, possibly related to resource consumption.
The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before version 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote attackers to conduct PHP object injection attacks via a crafted string containing <cross-domain-policy> in a PHP format request.
In Microweber CMS version 0.95 before 20141209, there is an SQL injection vulnerability in Category.php that allows remote attackers to execute arbitrary SQL commands via the category parameter.
Multiple SQL injection vulnerabilities in index.php in SweetRice CMS before version 0.6.7.1 allow remote attackers to execute arbitrary SQL commands through various parameters.
In the CGI component in PHP, through version 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, there is a vulnerability related to improper consideration of the mapping's length when processing an invalid .php file, leading to out-of-bounds read.
The batadv_frag_merge_packets function in the B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an incorrect length field during a calculation of an amount of memory, which allows remote attackers to cause a denial of service (mesh-node system crash) via fragmented packets.
Heap-based buffer overflow in the GDB debugger module in Hex-Rays IDA Pro before 6.6 cumulative fix 2014-12-24 allows remote GDB servers to have unspecified impact.
Buffer overflow in NotePad++ version 6.6.9 allows remote attackers to have unspecified impact via a long Time attribute in an Event element in an XML file.
CVE-2014-9455 is an SQL injection vulnerability in showads.php in CTS Projects & Software ClassAd 3.0 that allows remote attackers to execute arbitrary SQL commands via the catid parameter.
Multiple stack-based buffer overflows in the DIVA web service API in VDG Security SENSE 2.3.13 allow remote attackers to execute arbitrary code via the user or password parameter in an AuthenticateUser request.
Multiple SQL injection vulnerabilities in Zabbix before 1.8.22, 2.0.x before 2.0.14, and 2.2.x before 2.2.8 in chart_bar.php allow remote attackers to execute arbitrary SQL commands via the itemid or periods parameter.