CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The IOHIDSecurePromptClient function in Apple OS X does not properly validate pointer values, allowing remote attackers to execute arbitrary code or cause a system crash via a crafted website.
Cisco IOS XR on ASR 9000 devices does not properly use compression for port-range and address-range encoding, allowing remote attackers to bypass intended Typhoon line-card ACL restrictions via transit traffic.
The DNP3 feature on Rockwell Automation Allen-Bradley MicroLogix 1400 1766-Lxxxxx A FRN controllers 7 and earlier and 1400 1766-Lxxxxx B FRN controllers before 15.001 allows remote attackers to cause a denial of service via malformed packets over an Ethernet network or a serial line.
A directory traversal vulnerability in SchneiderWEB on Schneider Electric Modicon PLC Ethernet modules allows remote attackers to access arbitrary resources via a crafted HTTP request.
CVE-2014-6298 in the mm_forum extension before version 1.9.3 for TYPO3 has an unrestricted file upload vulnerability. Remote attackers can upload a file with an executable extension and access it, allowing arbitrary code execution.
CVE-2014-6295 describes an SQL injection vulnerability in the WEC Map (wec_map) extension before version 3.0.3 for TYPO3, allowing remote attackers to execute arbitrary SQL commands via unspecified vectors.
SQL injection vulnerability in the Statistics (ke_stats) extension before 1.1.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
The News (tt_news) extension before 3.5.2 for TYPO3 allows remote attackers to have unspecified impact via vectors related to an 'insecure unserialize' issue.
The Yet Another Gallery (yag) extension before 3.0.1 and Tools for Extbase development (pt_extbase) extension before 1.5.1 have a vulnerability that allows remote attackers to bypass access restrictions and execute arbitrary controller actions.
The powermail extension 2.x before 2.0.11 for TYPO3 allows remote attackers to bypass the CAPTCHA protection mechanism via unspecified vectors.
CVE-2014-3947 in the powermail extension before 1.6.11 and 2.x before 2.0.14 for TYPO3 has an unrestricted file upload vulnerability. Remote attackers can execute arbitrary code by uploading a file with a crafted extension.
The administration console in IBM Security Access Manager for Web 7.x before 7.0.0-ISS-WGA-IF0009 and 8.x before 8.0.0-ISS-WGA-FP0005, and Security Access Manager for Mobile 8.x before 8.0.0-ISS-ISAM-FP0005, allows remote attackers to inject system commands via unspecified vectors.
The WebSEAL component in IBM Security Access Manager for Web 7.x before 7.0.0-ISS-WGA-IF0009 and 8.x before 8.0.0-ISS-WGA-FP0005, when e-community SSO is enabled, allows remote attackers to cause a denial of service (component hang) via unspecified vectors.
The hvm_msr_read_intercept function in Xen 4.1 through 4.4.x uses an improper MSR range for x2APIC emulation, allowing local HVM guests to cause a denial of service (host crash) or read data from the hypervisor or other guests via unspecified vectors.
Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network and capturing a session cookie.
Unspecified vulnerability in the Administrative Console on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network.
SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the posts variable.
Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow.
In gtbn.py in Plone before 4.2.3 and 4.3 before beta 1, remote authenticated users with certain permissions can bypass the Python sandbox and execute arbitrary Python code via unspecified vectors.
The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing.