CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in WordPress 0.70 allows remote attackers to execute arbitrary PHP code via remote file inclusion. The issue exists in wp-links/links.all.php, where attackers can manipulate the $abspath variable.
A stack-based buffer overflow in rtsold in FreeBSD from version 9.1 through 10.1-RC2 can be exploited by remote attackers. Attackers can cause a denial of service (crash) or potentially execute arbitrary code by sending crafted DNS parameters in a router advertisement message.
EGroupware Enterprise Line before version 1.1.20140505, EGroupware Community Edition before version 1.8.007.20140506, and EGroupware before version 14.1 beta allow remote authenticated administrators to execute arbitrary PHP code via crafted callback values to the call_user_func PHP function.
The from_yaml method in serializers.py in Django Tastypie before version 0.9.10 does not properly deserialize YAML data, allowing remote attackers to execute arbitrary Python code.
The emitters.py file in Django Piston before version 0.2.3 and in 0.2.x before 0.2.2.1 has an issue with deserializing YAML data, allowing remote attackers to execute arbitrary Python code.
CVE-2014-5520 is a SQL injection vulnerability in XRMS CRM, possibly in version 1.99.2. It allows remote attackers to execute arbitrary SQL commands via the user_id parameter in plugins/webform/new-form.php, which is not properly handled by plugins/useradmin/fingeruser.php.
F5 BIG-IP Analytics 11.x before 11.4.0 uses a predictable session cookie, making it easier for remote attackers to guess its value.
Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows remote attackers to execute arbitrary code by uploading a ZIP file which contains an executable file with .. (dot dot) sequences in its name.
CVE-2013-1641 is a vulnerability in the zip download functionality in QuiXplorer before version 2.5.5 that allows remote attackers to read arbitrary files via a directory traversal attack using the .. (dot dot) in the selitems[] parameter.
The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, allowing attackers to execute arbitrary code via shell metacharacters in unspecified vectors.
The Remote Controls feature on Samsung mobile devices does not validate the source of lock-code data received over a network, which makes it easier for remote attackers to cause a denial of service (screen locking with an arbitrary code) by triggering unexpected Find My Mobile network traffic.
The displayServiceStatus.php file in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) contains a vulnerability that allows remote attackers to execute arbitrary commands via shell metacharacters in the session_id or template_id parameters, related to the command_line variable.
Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 allow remote attackers to execute arbitrary SQL commands. These issues have been fixed in Centreon web 2.5.3.
The Calendar Base (cal) extension before 1.5.9 and 1.6.x before 1.6.1 for TYPO3 allows remote attackers to cause a denial of service (resource consumption) via vectors related to the PHP PCRE library.
Podatność CVE-2014-6352 dotyczy systemów Microsoft Windows, w tym Vista, Server 2008, 7, 8, 8.1 oraz RT. Umożliwia zdalnym atakującym wykonanie dowolnego kodu poprzez spreparowany obiekt OLE, co zostało wykorzystane w praktyce w październiku 2014 roku za pomocą spreparowanego dokumentu PowerPoint.
Unspecified vulnerability in Shim might allow attackers to execute arbitrary code via a crafted MOK list, which triggers memory corruption.
CVE-2014-3676 involves a heap-based buffer overflow in Shim that allows remote attackers to execute arbitrary code via a crafted IPv6 address, related to the 'tftp:// DHCPv6 boot option.'
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before version 9 build 90055 allows remote attackers to execute arbitrary code via a .. (dot dot) in the fileName parameter to mdm/mdmLogUploader.
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central before version 9 build 90055 allows remote attackers to execute arbitrary code via a .. (dot dot) in the fileName parameter in an LFU action to statusUpdate.
Unspecified vulnerability in the management interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.x before version 10.1-129.11 and 10.5 before version 10.5-50.10 allows remote attackers to execute arbitrary code via unknown vectors.