CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
UnRTF allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code as demonstrated by a file containing the string "{\cb-999999999".
A stack-based buffer overflow in the srec_scan function in bfd/srec.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted file.
A stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted ihex file.
A heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils version 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a truncated export table in a PE file.
The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) and possibly have other unspecified impact via a crafted NumberOfRvaAndSizes field in the AOUT header in a PE executable.
The setup_group function in bfd/elf.c in libbfd in GNU binutils version 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted section group headers in an ELF file.
SQL injection vulnerability in the formulaireRobot function in admin/robots.lib.php in RobotStats 1.0 allows remote attackers to execute arbitrary SQL commands via the robot parameter to admin/robots.php.
CVE-2014-9347 is an SQL injection vulnerability in dosearch.php in phpMyRecipes version 1.2.2 that allows remote attackers to execute arbitrary SQL commands via the words_exact parameter.
Versions 6.6 and earlier of Guruperl.net Advertise With Pleasure! Professional (AWP PRO) contain an SQL injection vulnerability. Remote attackers can execute arbitrary SQL commands via the group_id parameter in a list_zone action to cgi/client.cgi.
The current_user_get_bug_filter function in core/current_user_api.php in MantisBT before 1.2.18 allows remote attackers to execute arbitrary PHP code via the filter parameter.
Multiple off-by-one errors in the jpc_dec_cp_setfromcox and jpc_dec_cp_setfromrgn functions in JasPer 1.900.1 and earlier allow remote attackers to execute arbitrary code via a crafted jp2 file, leading to a heap-based buffer overflow.
Buffer overflow in Hikvision DVR DS-7204 Firmware 2.2.10 build 131009 and other models and versions allows remote attackers to execute arbitrary code via an RTSP PLAY request with a long Authorization header.
Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in various commands.
Emerson Process Management ROC800 RTU with software version 3.50 and earlier, DL8000 RTU with software version 2.30 and earlier, and ROC800L RTU with software version 1.20 and earlier allow remote attackers to execute arbitrary commands via a TCP replay attack.
Plex Media Server before version 0.9.9.3 allows remote attackers to bypass the web server whitelist, conduct SSRF attacks, and execute arbitrary administrative actions via multiple crafted X-Plex-Url headers to system/proxy, which are inconsistently processed by the request handler in the backend web server.
The EntryPass N5200 Active Network Control Panel allows remote attackers to read device memory and obtain the administrator username and password via a specific URL.
The EntryPass N5200 Active Network Control Panel does not properly restrict access, allowing remote attackers to obtain the administrator username and password, and possibly other sensitive information via a request to /4.
The KDE Clock KCM policykit helper in kde-workspace before 4.11.14 and plasma-desktop before 5.1.1 allows local users to gain privileges via a crafted ntpUtility (ntp utility name) argument.
IBM Tivoli Endpoint Manager MDM before version 9.0.60100 uses the same secret HMAC token across different customers' installations, allowing remote attackers to execute arbitrary code via crafted marshalled Ruby objects in cookies.
EMC Documentum Content Server versions 7.0, 7.1 before 7.1 P10, and 6.7 before SP2 P19 allow remote authenticated users to read or delete arbitrary files via unspecified vectors related to an insecure direct object reference.