CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2014-9220 describes an SQL injection vulnerability in OpenVAS Manager before version 4.0.6 and 5.x before version 5.0.7. It allows remote attackers to execute arbitrary SQL commands via the timezone parameter in a modify_schedule OMP command.
The installer in Thomson Reuters Fixed Assets CS 13.1.4 and earlier uses weak permissions for connectbgdl.exe, allowing local users to execute arbitrary code by modifying this program.
ZTE ZXDSL 831CII has a default password of 'admin' for the admin account, which allows remote attackers to gain administrator privileges.
The Smarty Pants Plugins SP Project & Document Manager plugin version 2.4.1 and earlier contains multiple SQL injection vulnerabilities in the classes/ajax.php file. Attackers can remotely execute arbitrary SQL commands through specific parameters in the functions.
The wpDataTables plugin version 1.5.3 and earlier contains an SQL injection vulnerability in the wpdatatables.php file. This allows remote attackers to execute arbitrary SQL commands via the table_id parameter in a get_wdtable action to wp-admin/admin-ajax.php.
The Google Doc Embedder plugin for WordPress before version 2.5.15 has an SQL injection vulnerability in view.php that allows remote attackers to execute arbitrary SQL commands via the gpid parameter.
CCH Wolters Kluwer ProSystem fx Engagement version 7.1 and earlier uses weak permissions for service files, allowing local users to gain LocalSystem privileges via a Trojan horse file.
CVE-2014-8728 describes an SQL injection vulnerability in the login page of Subex ROC Fraud Management in version 7.4 and earlier. It allows remote attackers to execute arbitrary SQL commands via the ranger_user[name] parameter.
The host-deny.sh script in OSSEC before version 2.8.1 writes to temporary files with predictable filenames without verifying ownership. This allows local users to modify access restrictions in hosts.deny and gain root privileges by creating the temporary files before automatic IP blocking occurs.
The _user_resource_create function in the Services module 7.x-3.x before 7.x-3.10 for Drupal uses a password of '1' when creating new user accounts, making it easier for remote attackers to guess the password via a brute force attack.
The Services module 7.x-3.x before 7.x-3.10 for Drupal does not properly limit the rate of authentication attempts, making it easier for remote attackers to gain access via a brute-force attack on the administrative password.
An integer underflow in the ksba_oid_to_str function in Libksba before version 1.3.2 allows remote attackers to cause a denial of service (crash) via a crafted OID in an S/MIME message or ECC based OpenPGP data.
Multiple SQL injection vulnerabilities in MantisBT before version 1.2.18 in view_all_bug_page.php allow remote attackers to execute arbitrary SQL commands via the sort or dir parameter to view_all_set.php.
The management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to obtain credentials by reading the configuration files.
ARRIS VAP2500 before FW08.41 does not properly validate passwords, allowing remote attackers to bypass authentication.
Unspecified vulnerability in the management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to execute arbitrary commands via unknown vectors.
Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the passthru PHP function.
The Apptha WordPress Video Gallery (contus-video-gallery) plugin version 2.5 has multiple SQL injection vulnerabilities that may allow remote attackers to execute arbitrary SQL commands.
Multiple SQL injection vulnerabilities in recover.php in Pligg CMS 2.0.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) n parameter.
Multiple SQL injection vulnerabilities in Raritan Power IQ versions 4.1.0 and 4.2.1 allow remote attackers to execute arbitrary SQL commands via the (1) sort or (2) dir parameter to license/records.