CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in the MRBS module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
SQL injection vulnerability in openSIS from version 4.5 to 5.3 allows remote attackers to execute arbitrary SQL commands via the Username and password to index.php.
The WordPress Spreadsheet (wpSS) plugin version 0.62 contains an SQL injection vulnerability in the ss_handler.php file, allowing remote attackers to execute arbitrary SQL commands via the ss_id parameter.
Schrack Technik microControl devices with firmware before version 1.7.0 (937) store sensitive information under the web root with insufficient access control. This allows remote attackers to obtain access data for ftp and telnet services via a direct request for ZTPUsrDtls.txt.
Multiple SQL injection vulnerabilities in the login in web_reports/cgi-bin/InfoStation.cgi in Innovative vtls-Virtua before version 2013.2.4 and 2014.x before version 2014.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter.
Multiple SQL injection vulnerabilities in Banana Dance B.2.6 and earlier allow remote attackers to execute arbitrary SQL commands via various parameters in PHP files.
CareFusion Pyxis SupplyStation 8.1 with hardware test tool before version 1.0.16 has a hardcoded service password, which makes it easier for remote attackers to obtain access via unspecified vectors.
IBM TRIRIGA Application Platform versions 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote attackers to execute arbitrary code via a crafted URL.
A memory leak in the tls_decrypt_ticket function in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service via a crafted session ticket that triggers an integrity-check failure.
A memory leak in OpenSSL 1.0.1 before 1.0.1j in the DTLS SRTP extension allows remote attackers to cause a denial of service through a crafted handshake message.
A race condition in the IP logging feature in Cisco Intrusion Prevention System (IPS) Software 7.1(7)E4 and earlier allows remote attackers to cause a denial of service (device reload) via crafted IP traffic that matches a problematic rule.
The Cisco TelePresence MCU Software before version 4.3(2.30) has a vulnerability that allows remote attackers to cause a denial of service through crafted TCP packets, leading to memory exhaustion.
Cisco TelePresence Video Communication Server (VCS) and Expressway Software before X8.1.1 are vulnerable to remote attacks that can lead to denial of service by sending crafted SIP packets.
The SIP IX implementation in Cisco TelePresence Video Communication Server (VCS) and Expressway Software before X8.1.1 allows remote attackers to cause a denial of service (device reload) via crafted SDP packets.
Cisco TelePresence Video Communication Server (VCS) and Expressway Software before X8.2 are vulnerable to an attack that can lead to a denial of service by sending a high rate of crafted packets. Attackers can remotely cause a device reload.
Apple OS X versions prior to 10.10 are vulnerable to an attack that can lead to denial of service via NULL pointer dereference when processing crafted ASN.1 data.
A heap-based buffer overflow in the kernel in Apple OS X before 10.10 allows physically proximate attackers to execute arbitrary code via crafted resource forks in an HFS filesystem.
The vulnerability in App Sandbox in Apple OS X before version 10.10 allows attackers to bypass the sandbox protection mechanism via the accessibility API.
Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
The CMS CORBA listener in SAP BusinessObjects BI Edge 4.0 allows remote attackers to cause a denial of service (server shutdown) via crafted OSCAFactory::Session ORB message.