CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Linux kernel up to version 3.17.2 has an issue with handling private syscall numbers in the ftrace subsystem, allowing local users to gain privileges or cause a denial of service via a crafted application.
The Linux kernel up to version 3.17.2 has an issue with handling private syscall numbers in the perf subsystem, which may allow local users to cause denial of service or bypass the ASLR protection mechanism via a crafted application.
The sctp_assoc_lookup_asconf_ack function in the SCTP implementation in the Linux kernel through version 3.17.2 allows remote attackers to cause a denial of service (panic) via duplicate ASCONF chunks that trigger an incorrect uncork within the side-effect interpreter.
The SCTP implementation in the Linux kernel through version 3.17.2 allows remote attackers to cause a denial of service (system crash) via a malformed ASCONF chunk.
A use-after-free vulnerability in the socket manager of Impress Remote in LibreOffice 4.x before 4.2.7 and 4.3.x before 4.3.3 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted request to TCP port 1599.
CVE-2014-4627 is an SQL injection vulnerability in EMC RSA Web Threat Detection versions 4.x before 4.6.1.1, allowing remote authenticated users to execute arbitrary SQL commands.
The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
The network-diagnostics administration interface in the Cisco RV router firmware on RV220W devices, RV120W devices, and RV180 and RV180W devices before specified versions allows remote authenticated users to execute arbitrary commands via a crafted HTTP request.
The SAP Promotion Guidelines (CRM-MKT-MPL-TPM-PPG) module for SAP CRM allows remote attackers to execute arbitrary code via unspecified vectors.
SQL injection vulnerability in SAP Contract Accounting allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
SQL injection vulnerability in Product Safety (EHS-SAF) component in SAP Environment, Health, and Safety Management allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
SQL injection vulnerability in Data Basis (BW-WHM-DBA) in SAP NetWeaver Business Warehouse allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Unspecified vulnerability in SAP Payroll Process allows remote attackers to cause a denial of service via vectors related to session handling.
The SAP CRM Internet Sales module allows remote attackers to execute arbitrary commands via unspecified vectors.
SAP Document Management Services allows local users to execute arbitrary commands via unspecified vectors.
The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH have default passwords, making it easier for remote attackers to gain access to sensitive information.
SQL injection vulnerability in info.php in CookieViz before version 1.0.1 allows remote web servers to execute arbitrary SQL commands via the domain parameter.
In the libavcodec library in FFmpeg before version 2.4.2, the number of channels is not constrained to at most 2, allowing remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted On2 data.
An off-by-one error in libavcodec/smc.c in FFmpeg before version 2.4.2 allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted Quicktime Graphics (SMC) video data.
In libavcodec/gifdec.c in FFmpeg before version 2.4.2, image heights are not properly computed, allowing remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted GIF data.