CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An unspecified vulnerability in the Automation Server in IBM Security AppScan Source versions 8 through 9.0.0.1 allows local users to gain privileges by executing a crafted service.
Unspecified vulnerability in the IBM Java Virtual Machine, as used in IBM WebSphere Real Time 3 before Service Refresh 7 FP1 and other products, allows remote attackers to gain privileges by leveraging the ability to execute code in the context of a security manager.
The EnergyWise module in Cisco IOS versions 12.2, 15.0, 15.1, 15.2, and 15.4 and IOS XE versions 3.2.xXO, 3.3.xSG, 3.4.xSG, and 3.5.xE before 3.5.3E allows remote attackers to cause a denial of service (device reload) via a crafted IPv4 packet.
The GPT library in the Telegyr 8979 Master Protocol application in SUBNET SubSTATION Server 2 before SSNET 2.12 HF18808 allows remote attackers to cause a denial of service (persistent service crash) via a long RTU-to-Master message.
The server in Cisco Unity Connection versions 9.1(1) and 9.1(2) allows remote authenticated users to obtain privileged access by conducting an 'HTTP Intercept' attack and leveraging the ability to read files within the context of the web-server user account.
Unity versions before 7.2.3 and 7.3.x before 7.3.1, as used in Ubuntu, does not properly take keyboard focus when switching to the lock screen, allowing physically proximate attackers to bypass the lock screen.
SQL injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote attackers to execute arbitrary SQL commands via the filter parameter.
The Lead Octopus plugin for WordPress contains an SQL injection vulnerability in lib/optin/optin_page.php, allowing remote attackers to execute arbitrary SQL commands via the id parameter.
A directory traversal vulnerability in the Admin Center for Tivoli Storage Manager (TSM) in Rocket ServerGraph 1.2 allows remote attackers to create, execute, read, and delete arbitrary files by manipulating query parameters.
Multiple SQL injection vulnerabilities in TeamPass before version 2.1.20 allow remote attackers to execute arbitrary SQL commands through various parameters in PHP files.
TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via a request to index.php followed by a direct request to a file that calls the session_start function before checking the CPM key.
TeamPass before version 2.1.20 allows remote attackers to bypass access restrictions via the language file path in a request to index.php or in a 'change_user_language' request to sources/main.queries.php.
The 'runshellscript echo.sh' script in Splunk before version 5.0.5 allows remote authenticated users to execute arbitrary commands via a crafted string.
CVE-2013-6771 is a directory traversal vulnerability in the collect script in Splunk before version 5.0.5 that allows remote attackers to execute arbitrary commands via a .. (dot dot) in the file parameter.
Unspecified vulnerability in the All Video Gallery (all-video-gallery) plugin before version 1.2.0 for WordPress may lead to unspecified impact and attack vectors.
CVE-2014-5089 is an SQL injection vulnerability in admin/options/logs.php in Status2k that allows remote authenticated administrators to execute arbitrary SQL commands via the log parameter.
Multiple SQL injection vulnerabilities in Sphider 1.3.6 and earlier, Sphider Pro, and Sphider-plus in admin/admin.php allow remote attackers to execute arbitrary SQL commands via the (1) site_id or (2) url parameter.
The NetBIOS name services daemon (nmbd) in Samba versions 4.0.x before 4.0.21 and 4.1.x before 4.1.11 allows remote attackers to execute arbitrary code via unspecified vectors that modify heap memory.
In ctdb versions before 2.3 in OpenSUSE 12.3 and 13.1, temporary files were not created securely, leading to unspecified impacts related to 'several temp file vulnerabilities'.
In the Yealink VoIP Phone SIP-T38G, in the cgi-bin/cgiServer.exx file, remote authenticated users can execute arbitrary commands by calling the system method in the body of a request. Examples include running unauthorized services, changing directory permissions, and modifying files.