CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple SQL injection vulnerabilities in Gogs (Go Git Service) versions 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter in the api/v1/repos/search and api/v1/users/search endpoints.
In Gogs (Go Git Service) versions 0.3.1-9 through 0.5.6.x before 0.5.6.1025 Beta, there is an SQL injection vulnerability in the GetIssues function. Remote attackers can execute arbitrary SQL commands via the label parameter to user/repos/issues.
A stack-based buffer overflow in Advantech WebAccess, formerly BroadWin WebAccess, allows remote attackers to execute arbitrary code via a crafted ip_address parameter in an HTML document.
The Protected Pages module 7.x-2.x before 7.x-2.4 for Drupal allows remote attackers to bypass the password protection via a crafted path.
Multiple SQL injection vulnerabilities in vldPersonals before version 2.7.1 allow remote attackers to execute arbitrary SQL commands via the (1) country, (2) gender1, or (3) gender2 parameter in a search action to index.php.
Lantronix xPrintServer does not properly restrict access to ips/, allowing remote attackers to execute arbitrary commands via the c parameter in an rpc action.
The DigitalVidhya Digi Online Examination System 2.0 has an unrestricted file upload vulnerability in the photo functionality, allowing remote attackers to execute arbitrary code by uploading a file with an executable extension.
In Advantech EKI-6340 2.05 Wi-Fi Mesh Access Point, a vulnerability in cgi/utility.cgi allows remote authenticated users to execute arbitrary commands via shell metacharacters in the pinghost parameter to ping.cgi.
The DfDiskLo.sys driver in Faronics Deep Freeze Standard and Enterprise 8.10 and earlier allows local administrators to cause a denial of service (crash) and execute arbitrary code via a crafted IOCTL request that writes to arbitrary memory locations.
Aruba Networks ClearPass before 6.3.5 and 6.4.x before 6.4.1 allows remote attackers to execute arbitrary commands via unspecified vectors. This is a different vulnerability than CVE-2014-5342.
Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 does not properly restrict access to unspecified administrative functions, allowing remote attackers to bypass authentication and execute administrative actions via unknown vectors.
The Policy Manager in Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 allows remote authenticated users to gain privileges via unspecified vectors.
Aruba Networks ClearPass before 6.3.5 and 6.4.x before 6.4.1 is vulnerable to remote command execution by attackers via unspecified vectors. This is a different vulnerability than CVE-2014-6627.
Multiple unspecified vulnerabilities in Google Chrome before version 39.0.2171.65 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Multiple integer overflows in the CheckMov function in media/base/container_names.cc in Google Chrome before version 39.0.2171.65 may allow remote attackers to cause a denial of service or possibly have unspecified other impact via a large atom in MPEG-4 or QuickTime .mov data.
Multiple use-after-free vulnerabilities in ScreenOrientationController.cpp in Blink, used in Google Chrome before version 39.0.2171.65, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger improper handling of a detached frame, related to the (1) lock and (2) unlock methods.
A use-after-free vulnerability in the Pepper plugins in Google Chrome before version 39.0.2171.65 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted Flash content that triggers an attempted PepperMediaDeviceManager access outside of the object's lifetime.
Buffer overflow in Skia, as used in Google Chrome before version 39.0.2171.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Buffer overflow in OpenJPEG before r2911 in PDFium, as used in Google Chrome before version 39.0.2171.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted JPEG image.
Use-after-free vulnerability in PDFium, as used in Google Chrome before version 39.0.2171.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document.