CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
EMC Documentum Content Server before version 6.7 SP2 P17, 7.0 through P15, and 7.1 before P08 does not properly check authorization for subgroups of privileged groups. This allows remote authenticated sysadmins to gain super-user privileges and bypass intended restrictions on data access and server actions.
EMC Documentum Content Server before version 6.7 SP2 P17, 7.0 through P15, and 7.1 before P08 does not properly check authorization for subtypes of protected system types. This allows remote authenticated users to obtain super-user privileges for system-object creation and bypass intended restrictions on data access and server actions.
The hook feature in the NtSetInformationFile system call in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows allows attackers to bypass a sandbox protection mechanism, enabling the execution of native code in a privileged context via an NTFS junction attack.
A heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 allows attackers to execute arbitrary code.
Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X are vulnerable to attacks that can lead to denial of service due to memory corruption.
A heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 allows attackers to execute arbitrary code.
Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.
SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Ecava IntegraXor SCADA Server versions 4.1.4360 and earlier and Beta 4.1.4392 and earlier allow remote attackers to read or write to arbitrary files, potentially leading to sensitive information disclosure or denial of service (disk consumption) via the CSV export feature.
An SQL injection vulnerability in MPEX Business Solutions MX-SmartTimer before version 13.19.18 in Login.aspx allows remote attackers to execute arbitrary SQL commands via the ct100%24CPHContent%24password parameter.
The mPAY24 payment module before version 1.6 for PrestaShop has an SQL injection vulnerability in confirm.php that allows remote attackers to execute arbitrary SQL commands via the TID parameter.
IBM Storwize 3500, 3700, 5000, and 7000 devices and SAN Volume Controller 6.x and 7.x before 7.2.0.8 allow remote attackers to reset the administrator superuser password to its default value via a direct request to the administrative IP address.
A memory leak in Cisco TelePresence System Edge MXP Series Software F9.3.3 and earlier allows remote attackers to cause a management outage via multiple TELNET connections.
SQL injection vulnerability in the wt_directory extension before version 1.4.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2014-6239 is an SQL injection vulnerability in the Address visualization with Google Maps (st_address_map) extension before version 0.3.6, allowing remote attackers to execute arbitrary SQL commands.
Unspecified vulnerability in the LumoNet PHP Include (lumophpinclude) extension before 1.2.1 for TYPO3 allows remote attackers to execute arbitrary scripts via vectors related to extension links.
Unspecified vulnerability in the ke DomPDF extension before 0.0.5 for TYPO3 allows remote attackers to execute arbitrary code via unknown vectors.
CVE-2014-6233 describes an SQL injection vulnerability in the Flat Manager (flatmgr) extension before version 2.7.10 for TYPO3, allowing remote attackers to execute arbitrary SQL commands via unspecified vectors.