CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The alterSearchQuery function in the CM Downloads Manager plugin for WordPress before version 2.0.4 allows remote attackers to execute arbitrary PHP code via the CMDsearch parameter.
SEIL series routers, including PPP Access Concentrator and Dial-Up Networking, are vulnerable to a denial of service attack that can lead to device restart. Attackers can exploit specially crafted GRE or MPPE packets to trigger this issue.
SEIL Series routers from Internet Initiative Japan Inc. in versions SEIL/X1 2.50 to 4.62, SEIL/X2 2.50 to 4.62, SEIL/B1 2.50 to 4.62, and SEIL/x86 Fuji 1.70 to 3.22 are vulnerable to denial of service attacks. Attackers can exploit a large number of NTP requests in a short time, leading to excessive CPU and traffic consumption.
FUJITSU F-12C, ARROWS Tab LTE F-01D, ARROWS Kiss F-03D, and REGZA Phone T-01D for Android allow local users to execute arbitrary commands via unspecified vectors.
In Lsyncd version 2.1.5 and earlier, the default-rsyncssh.lua script allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.
The hx170dec device driver in Huawei P2-6011 before V100R001C00B043 allows local users to read and write to arbitrary memory locations via unspecified vectors.
The CheckEmail function in includes/functions.class.php in PBBoard 3.0.1 before 20141128 has an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the email parameter on the registration page.
Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to execute arbitrary commands via shell metacharacters in the ping field (setobject_ip parameter).
CVE-2014-3997 describes an SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro and IT360, allowing remote attackers to execute arbitrary SQL commands.
SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central and other ManageEngine products allows remote attackers to execute arbitrary SQL commands via the sv parameter.
Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to execute arbitrary SQL commands.
SQL injection vulnerability in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the probeName parameter.
Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, 11.3, and earlier allows remote attackers to write and execute arbitrary files via a .. (dot dot) in the FILENAME parameter.
CVE-2014-9242 is an SQL injection vulnerability in admin/pages/modify.php in WebsiteBaker 2.8.3 that allows remote attackers to execute arbitrary SQL commands via the page_id parameter.
MyBB (MyBulletinBoard) versions 1.8.x before 1.8.2 have an SQL injection vulnerability in member.php that allows remote attackers to execute arbitrary SQL commands via the question_id parameter in a do_register action.
SQL injection vulnerability in the IPS Connect service in Invision Power Board 3.3.x and 3.4.x through 3.4.7 before 20141114 allows remote attackers to execute arbitrary SQL commands via the id[] parameter.
SQL injection vulnerability in Proticaret E-Commerce 3.0 allows remote attackers to execute arbitrary SQL commands via a tem:Code element in a SOAP request.
CVE-2014-9157 is a vulnerability in the yyerror function in the Graphviz library that allows remote attackers to exploit format string specifiers in unknown vectors, leading to unspecified impact.
An unrestricted file upload vulnerability in the Huawei Honor Cube Wireless Router WS860s before V100R001C02B222 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
Canto Curses before version 0.9.0 contains a vulnerability that allows remote feed servers to execute arbitrary commands via shell metacharacters in a feed URL.