CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in Mini-stream RM-MP3 Converter 3.1.2.1.2010.03.30 allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a long string in a WAX file.
SQL injection vulnerability in incl/create.inc.php in Installatron GQ File Manager 0.2.5 allows remote attackers to execute arbitrary SQL commands via the create parameter to index.php.
CVE-2014-9440 is an SQL injection vulnerability in browse.php in phpMyRecipes version 1.2.2 that allows remote attackers to execute arbitrary SQL commands via the category parameter.
Multiple SQL injection vulnerabilities in Redaxscript version 0.3.2 in includes/password.php allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) password parameter to the password_reset program.
The cdnvote plugin before version 0.4.2 for WordPress has multiple SQL injection vulnerabilities in cdnvote-post.php that allow remote attackers to execute arbitrary SQL commands via the cdnvote_post_id or cdnvote_point parameters.
Buffer overflow in the Download method in a certain ActiveX control in MDIEEx.dll in Gogago YouTube Video Converter 1.1.6 allows remote attackers to execute arbitrary code via a long argument.
The cmdSave method in the ThreeDify.ThreeDifyDesigner.1 ActiveX control in ActiveSolid.dll version 5.0.2 allows remote attackers to write to arbitrary files via a pathname in the argument.
The EaseWeFtp.FtpLibrary ActiveX control in Easewe FTP OCX 4.5.0.9 does not restrict access to certain methods, allowing remote attackers to execute arbitrary files and manipulate files and folders on the local system.
Multiple buffer overflows in the ThreeDify.ThreeDifyDesigner.1 ActiveX control in ActiveSolid.dll in version 5.0.2 allow remote attackers to execute arbitrary code via a long argument to the (1) cmdExport, (2) cmdImport, (3) cmdOpen, or (4) cmdSave method.
The Social Slider plugin before version 7.4.2 for WordPress has an SQL injection vulnerability in ajax.php, allowing remote attackers to execute arbitrary SQL commands via the rA array parameter.
Multiple heap-based buffer overflows in Sound eXchange (SoX) 14.4.1 and earlier allow remote attackers to have unspecified impact via a crafted WAV file to the start_read or AdpcmReadBlock function.
The bb_func_unsub.php file in MiniBB 3.1 before version 20141127 contains an incorrect regular expression, allowing remote attackers to conduct SQL injection attacks via the code parameter in an unsubscribe action to index.php.
The apprentice_load function in the Fileinfo component in PHP through version 5.6.4 attempts to perform a free operation on a stack-based character array, which may lead to application crashes or memory corruption.
A double free vulnerability in the zend_ts_hash_graceful_destroy function in the Zend Engine in PHP through 5.5.20 and 5.6.x through 5.6.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVE-2013-3295 in Exponent CMS before version 2.2.0 RC1 has a directory traversal vulnerability. It allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.
The VideoWhisper Live Streaming Integration plugin before version 4.29.5 for WordPress has an unrestricted file upload vulnerability. An attacker can upload a file with a double extension, allowing arbitrary PHP code execution.
A double free vulnerability in the ssl_parse_clienthello_use_srtp_ext function in LibreSSL before version 2.1.2 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a certain length-verification error during DTLS handshake processing.
Integer overflow in the string_chunk_split function in Facebook HipHop Virtual Machine (HHVM) before version 3.3.0 can lead to application crashes or other unspecified impacts via crafted arguments to the chunk_split function.
CRLF injection vulnerability in the LightProcess protocol implementation in Facebook HipHop Virtual Machine (HHVM) before version 2.4.2 allows remote attackers to execute arbitrary commands by entering a newline character before the end of a string.
CVE-2011-4722 describes a vulnerability in TFTP Server 1.0.0.24 in Ipswitch WhatsUp Gold that allows remote attackers to read arbitrary files by using .. (dot dot) in the Filename field of an RRQ operation.