CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The sctp_assoc_update function in the Linux kernel through version 3.15.8, when SCTP authentication is enabled, allows remote attackers to cause a denial of service through NULL pointer dereference.
The Linux kernel before version 3.15.8 on the s390 platform has a vulnerability that improperly restricts address-space control operations in PTRACE_POKEUSR_AREA requests. This allows local users to gain read and write access to kernel memory, potentially leading to privilege escalation.
The kgsl graphics driver for Linux kernel 3.x improperly prevents write access to IOMMU context registers, allowing local users to select a custom page table. Consequently, they can write to arbitrary memory locations by using a crafted GPU command stream.
The License Measurement servlet in SAP Solution Manager 7.1 allows remote attackers to bypass authentication via unspecified vectors, related to a verb tampering attack and SAP_JTECHS.
SQL injection vulnerability in the Unified Task List (UTL) Portlet for IBM WebSphere Portal 7.x and 8.x through 8.0.0.1 CF12 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
WeBid version 1.1.1 allows remote attackers to conduct an LDAP injection attack via the (1) js or (2) cat parameter.
The Repositories component in Moodle through 2.3.11, and in versions 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via serialized data associated with an add-on.
Domyślna konfiguracja w Elasticsearch przed wersją 1.2 umożliwia dynamiczne skrypty, co pozwala zdalnym atakującym na wykonywanie dowolnych wyrażeń MVEL i kodu Java za pomocą parametru source w zapytaniu _search. Problem ten występuje tylko, jeśli użytkownik nie uruchamia Elasticsearch w niezależnej maszynie wirtualnej.
Unspecified vulnerability in HP and H3C VPN Firewall Module products SECPATH1000FE before version 5.20.R3177 and SECBLADEFW before version 5.20.R3177 allows remote attackers to cause a denial of service via unknown vectors.
The home module in Fonality trixbox has a vulnerability that allows remote attackers to execute arbitrary commands via shell metacharacters in the lang parameter.
SQL injection vulnerability in endpoint_generic.php in Fonality trixbox allows remote attackers to execute arbitrary SQL commands via the mac parameter in a Submit action.
Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands via various parameters in PHP scripts.
An unspecified vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before version 2.6.8 for WordPress may lead to unspecified impact and attack vectors.
The MailPoet Newsletters (wysija-newsletters) plugin before version 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme.
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, allowing local users to write data to arbitrary memory locations. This can lead to privilege escalation via a crafted address in an IOCTL call, related to the MQAC.sys and BthPan.sys drivers.
Directory traversal vulnerability in the toServerObject function in HP Network Virtualization 8.6 allows remote attackers to create files, and consequently execute arbitrary code, via crafted input.
Directory traversal vulnerability in the storedNtxFile function in HP Network Virtualization 8.6 allows remote attackers to read arbitrary files via crafted input.
Apple QuickTime allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a malformed version number and flags in an mvhd atom.
Multiple SQL injection vulnerabilities in CWPLogin.aspx in Sabre AirCentre Crew products version 2010.2.12.20008 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password field.
Morpho Itemiser 3 version 8.17 has hardcoded administrative credentials, making it easier for remote attackers to gain access via a login request.