CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Shenzhen Tenda Technology Tenda A5s router with firmware 3.02.05_CN allows remote attackers to bypass authentication and gain administrator access by setting the admin:language cookie to zh-cn.
Multiple SQL injection vulnerabilities in Free Reprintables ArticleFR 3.0.4 and earlier allow remote attackers to execute arbitrary SQL commands via the id parameter in a (1) get or (2) set action to rate.php.
Multiple SQL injection vulnerabilities in Bank Soft Systems (BSS) RBS BS-Client 3.17.9 allow remote attackers to execute arbitrary SQL commands via the (1) CARDS or (2) XACTION parameter.
Unspecified vulnerability in Apache Traffic Server versions 3.x through 3.2.5, 4.x before 4.2.1.1, and 5.x before 5.0.1. This vulnerability may be related to health checks, but its impact and attack vectors are unknown.
IBM WebSphere Application Server (WAS) versions 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.3, when Load Balancer for IPv4 Dispatcher is enabled, allows remote attackers to cause a denial of service (Load Balancer crash) via unspecified vectors.
The av-centerd SOAP service in AlienVault OSSIM before version 4.7.0 allows remote attackers to execute arbitrary commands via crafted remote_task or get_license requests.
CVE-2014-5159 is a SQL injection vulnerability in the ossim-framework service in AlienVault OSSIM before version 4.6.0. It allows remote attackers to execute arbitrary SQL commands via the ws_data parameter.
The av-centerd SOAP service and backup command in the ossim-framework service in AlienVault OSSIM before version 4.6.0 allow remote attackers to execute arbitrary commands via unspecified vectors.
EMC Documentum Content Server before 6.7 SP2 P16 and 7.x before 7.1 P07 allows remote authenticated users to gain privileges via a user-created system object.
Active Record in Ruby on Rails versions 4.0.x before 4.0.9 and 4.1.x before 4.1.5 has a vulnerability that allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes create_with calls.
EMC Documentum D2 versions 3.1 before P24, 3.1SP1 before P02, 4.0 before P11, 4.1 before P16, and 4.2 before P05 do not properly restrict tickets provided by D2GetAdminTicketMethod and D2RefreshCacheMethod. This allows remote authenticated users to gain privileges via a request for a superuser ticket.
RESTEasy versions 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, used in Red Hat JBoss EAP 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false. This allows remote attackers to read arbitrary files and have other unspecified impacts related to an XML External Entity (XXE) issue.
SQL injection vulnerability in OSK Advance-Flow 4.41 and earlier and Advance-Flow Forms 4.41 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
The do_remount function in the Linux kernel up to version 3.16.1 does not maintain the MNT_LOCK_READONLY bit across a remount of a bind mount, allowing local users to bypass an intended read-only restriction.
The wp-includes/class-wp-customize-widgets.php file in the widget implementation in WordPress 3.9.x before 3.9.2 may allow remote attackers to execute arbitrary code via crafted serialized data.
Siemens SIMATIC S7-1500 CPU devices with firmware before version 1.6 are vulnerable to remote attacks that can cause denial of service by sending crafted TCP packets, resulting in device restart and STOP transition.
In IBM GCM16 and GCM32 Global Console Manager, versions before firmware 1.20.20.23447, the systest.php file allows remote authenticated users to execute arbitrary commands via shell metacharacters in the lpres parameter.
IBM InfoSphere Master Data Management - Collaborative Edition versions 10.x before 10.1-FP11 and 11.x before 11.0-FP5, as well as InfoSphere Master Data Management Server for Product Information Management versions 9.x before 9.1-FP15 and 10.x and 11.x before 11.3-IF2, allow local users to obtain administrator privileges via unspecified vectors.
The Terminal Upgrade Tool in the Pilot Below Deck Equipment (BDE) and OpenPort implementations on Iridium satellite terminals allows remote attackers to execute arbitrary code by uploading new firmware to TCP port 54321.
The Pilot Below Deck Equipment (BDE) and OpenPort implementations on Iridium satellite terminals allow remote attackers to read hardcoded credentials via the web interface.