CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
APT versions before 1.0.9 do not verify downloaded files if they have been modified as indicated by the If-Modified-Since header. This can lead to unspecified impacts and attack vectors.
Smarty before 3.1.21 allows remote attackers to bypass the secure mode restrictions and execute arbitrary PHP code, as demonstrated by "{literal}<{/literal}script language=php>" in a template.
iBackup version 10.0.0.32 and earlier uses weak permissions (Everyone: Full Control) for ib_service.exe, allowing local users to gain privileges via a Trojan horse file.
A heap-based buffer overflow exists in the encode_slice function in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3 and in Libav before 10.5. Remote attackers can cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors.
Rsyslog versions before 7.6.6 and 8.x before 8.4.1 and sysklogd version 1.5 and earlier allow remote attackers to cause a denial of service (crash), possibly execute arbitrary code, or have other unspecified impact via a crafted priority (PRI) value that triggers an out-of-bounds array access.
A stack-based buffer overflow in the normify function in the rlm_pap module in FreeRADIUS may lead to denial of service and potentially allow arbitrary code execution via a long password hash.
Linksys SMART WiFi firmware on EA2700, EA3500, E4200v2, EA4500, EA6200, EA6300, EA6400, EA6500, EA6700, and EA6900 devices before specified versions allows remote attackers to obtain sensitive information or modify data via a JNAP action in a JNAP/HTTP request.
The lazy_bdecode function in BitTorrent bootstrap-dht allows remote attackers to execute arbitrary code via a crafted packet, triggering an out-of-bounds read, related to 'Improper Indexing.'
The execSetResults.php file in TestLink before version 1.9.13 has a vulnerability that allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the filter_result_result parameter.
Directory traversal vulnerability in EspoCRM before version 2.6.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action parameter to install/index.php.
Buffer overflow in ALLPlayer versions 5.6.2 through 5.8.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a .m3u (playlist) file.
BSS Continuity CMS 4.2.22640.0 has an SQL injection vulnerability in getnode.aspx that allows remote attackers to execute arbitrary SQL commands via the nodeid parameter.
McAfee Network Data Loss Prevention (NDLP) before 9.3 allows remote attackers to execute arbitrary code via vectors related to ICMP redirection.
Unspecified vulnerability in McAfee Network Data Loss Prevention (NDLP) before version 9.3 allows remote attackers to obtain sensitive information, affect integrity, or cause a denial of service via unknown vectors, related to simultaneous logins.
The MySQL database in McAfee Network Data Loss Prevention (NDLP) before version 9.3 does not require a password, making it easier for remote attackers to gain access.
CVE-2014-4877 in GNU Wget before version 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, leading to arbitrary code execution. This issue occurs in a LIST response that references the same filename in two entries, one of which indicates that the filename is for a symlink.
Integer overflow in the object_custom function in var_unserializer.c in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an argument to the unserialize function that triggers calculation of a large length value.
Etiko CMS has multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. The attack can be carried out via the page_id parameter in loja/index.php or the article_id parameter in index.php.
CVE-2012-5580 describes a format string vulnerability in the print_proxies function in bin/proxy.c in libproxy 0.3.1, which may allow attackers to cause a denial of service (crash) and potentially execute arbitrary code via format string specifiers in a proxy name.
In server/sv_main.c of Quake3 Arena, used in ioquake3 before r1762, OpenArena, Tremulous, and other products, remote attackers can cause a denial of service (network traffic amplification) via a spoofed (1) getstatus or (2) rcon request.