CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The DNP3 driver in CG Automation ePAQ-9410 Substation Gateway allows remote attackers to cause a denial of service via a crafted TCP packet, leading to an infinite loop or process crash.
Google Chrome before 37.0.2062.94 does not properly handle the interaction of extensions, IPC, the sync API, and Google V8, which allows remote attackers to execute arbitrary code via unspecified vectors.
Google Chrome before 37.0.2062.94 does not properly handle the interaction of extensions, IPC, the sync API, and Google V8, allowing remote attackers to execute arbitrary code via unspecified vectors.
Multiple unspecified vulnerabilities in Google Chrome before version 37.0.2062.94 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors, related to the load_truetype_glyph function in truetype/ttgload.c in FreeType and other functions in other components.
A use-after-free vulnerability in the V8 bindings in Blink, used in Google Chrome before version 37.0.2062.94, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper use of HashMap add operations instead of HashMap set operations.
A use-after-free vulnerability in the DOM implementation in Blink, used in Google Chrome before version 37.0.2062.94, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging script execution that occurs before notification of node removal.
Use-after-free vulnerability in the SVG implementation in Blink, used in Google Chrome before version 37.0.2062.94, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper caching associated with animation.
There is a heap-based buffer overflow in the PavTPK.sys kernel mode driver of Panda Security 2014 products before hft131306s24_r1. Local users can gain elevated privileges via a crafted argument to a 0x222008 IOCTL call.
Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and possibly have other unspecified impact via a crafted Calc spreadsheet.
SQL injection vulnerability in sqrl_verify.php in php-sqrl allows remote attackers to execute arbitrary SQL commands via the message parameter.
Ubisoft Uplay PC before 4.6.1.3217 uses weak permissions (Everyone: Full Control) for the program installation directory, allowing local users to gain privileges via a Trojan horse file.
The FortiManager protocol service in Fortinet FortiOS before version 4.3.16 and before version 5.0.8 on FortiGate devices allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted request.
The cmd_boot function in the Little Kernel (LK) bootloader allows attackers to bypass device-lock and kernel-signature restrictions by using fastboot mode to boot an arbitrary kernel image.
The image_verify function in the Little Kernel (LK) bootloader does not check whether a certain digest size is consistent with the RSA_public_decrypt API specification, allowing attackers to bypass boot-image authentication requirements via trailing data.
Unspecified vulnerability in the server in HP Service Manager (SM) 7.21 and 9.x before 9.34 allows remote attackers to bypass intended access restrictions, and modify data or cause a denial of service, via unknown vectors.
Unspecified vulnerability in the WebTier component in HP Service Manager (SM) 7.21 and 9.x before 9.34 allows remote attackers to execute arbitrary code via unknown vectors.
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before version 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.
The web interface in Schrack Technik microControl with firmware before version 1.7.0 (937) has a hardcoded password for the 'user' account. This makes it easier for remote attackers to gain access to the system.
CVE-2014-5262 is a SQL injection vulnerability in the graph settings script (graph_settings.php) in Cacti versions 0.8.8b and earlier. It allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
The graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a font size, related to the rrdtool commandline in lib/rrd.php.