CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Google Chrome before 38.0.2125.101 and Chrome OS before 38.0.2125.101 do not properly handle the interaction of IPC and Google V8, allowing remote attackers to execute arbitrary code via vectors involving JSON data, related to improper parsing of an escaped index by ParseJsonObject in json-parser.h.
An unspecified vulnerability in administrative interfaces in ArubaOS 6.3.1.11, 6.3.1.11-FIPS, 6.4.2.1, and 6.4.2.1-FIPS on Aruba controllers allows remote attackers to bypass authentication and obtain potentially sensitive information or add guest accounts via an SSH session.
The ARI Framework module in FreePBX before version 2.9.0.9, 2.10.x, and 2.11 before 2.11.1.5 has a vulnerability that allows remote attackers to execute arbitrary code via the ari_auth cookie, related to the PHP unserialize function.
gpExec in GoPro HERO 3+ allows remote attackers to execute arbitrary commands via the (1) a1 or (2) a2 parameter in a restart action.
CVE-2014-6433 vulnerability in GoPro HERO 3+ allows remote attackers to execute arbitrary files via the a1 or a2 parameter in a start action.
CVE-2014-5503 describes an SQL injection vulnerability in the Guest Login Portal in Sophos Cyberoam appliances with CyberoamOS before version 10.6.1 GA. This allows remote attackers to execute arbitrary SQL commands via the add_guest_user opcode.
Sophos Cyberoam appliances with CyberoamOS before version 10.6.1 GA allow remote authenticated users to inject arbitrary commands via specific opcodes.
A stack-based buffer overflow in the diagnose service in Sophos Cyberoam appliances with CyberoamOS before version 10.6.1 GA allows remote attackers to execute arbitrary code via a crafted webpage or file.
The default configuration in a sudoers file in the Red Hat openstack-neutron package before version 2014.1.2-4 allows remote attackers to gain privileges via a crafted configuration file.
The vyatta-clear-dhcp-lease.pl script on Brocade Vyatta 5400 vRouter 6.4R(x), 6.6R(x), and 6.7R1 does not properly validate parameters, allowing local users to gain elevated privileges by leveraging the sudo configuration.
The management console on the Brocade Vyatta 5400 in versions 6.4R(x), 6.6R(x), and 6.7R1 allows remote authenticated users to execute arbitrary Linux commands via shell metacharacters in a console command.
M/Monit 3.3.2 and earlier does not verify the original password before changing passwords, allowing remote attackers to change other users' passwords and gain privileges via the fullname and password parameters.
The backup.php file in PHPCompta/NOALYSS before version 6.7.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the d parameter.
The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specification, allowing context-dependent attackers to trigger use-after-free vulnerabilities.
CVE-2014-2044 describes an incomplete blacklist vulnerability in ajax/upload.php in ownCloud before version 5.0, running on Windows. This allows remote authenticated users to bypass intended access restrictions, upload files with arbitrary names, and execute arbitrary code via an Alternate Data Stream (ADS) syntax in the filename parameter.
Multiple unspecified vulnerabilities in libXtsol in Oracle Solaris 10 and 11.1 related to buffer errors.
The XMonad.Hooks.DynamicLog module in xmonad-contrib before version 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title.
The Content Audit plugin before version 1.6.1 for WordPress contains an SQL injection vulnerability in the content-audit-schedule.php file. This allows remote attackers to execute arbitrary SQL commands via the 'Audited content types' option on the content audit page.
Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty username or password.
Multiple cross-site request forgery (CSRF) vulnerabilities on the TP-LINK WR1043N router with firmware TL-WR1043ND_V1_120405 allow remote attackers to hijack the authentication of administrators for various requests, such as enabling FTP access or changing the FTP administrative password.