CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2014-5102 is an SQL injection vulnerability in vBulletin versions 5.0.4 through 5.1.3 Alpha 5. It allows remote attackers to execute arbitrary SQL commands via the criteria[startswith] parameter to ajax/render/memberlist_items.
Buffer overflow in ACME micro_httpd, used in D-Link DSL2750U, DSL2740U, and NetGear WGR614 and MR-ADSL-DG834 routers, allows remote attackers to cause a denial of service (crash) via a long string in the URI in a GET request.
SQL injection vulnerability in E2 before version 2.4 (2845) allows remote attackers to execute arbitrary SQL commands via the note-id parameter to @actions/comment-process.
Honeywell FALCON XLWeb Linux controller devices version 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices version 2.02.11 and earlier allow remote attackers to bypass authentication and gain administrative access by visiting the change-password page.
OleumTech WIO DH2 Wireless I/O Modules rely exclusively on a time value for entropy in key generation, making it easier for remote attackers to defeat cryptographic protection mechanisms by predicting the time of project creation.
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules do not require authentication to read the site security key, allowing nearby attackers to spoof communication.
CVE-2014-0607 in Attachmate Verastream Process Designer (VPD) before R6 SP1 Hotfix 1 has an unrestricted file upload vulnerability that allows remote attackers to execute arbitrary code by uploading and launching an executable file.
Multiple heap-based buffer overflows in the parse_notify function in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 4.1.0 allow remote pool servers to have unspecified impact via a large or negative value in the Extranonc2_size parameter in a mining.subscribe response and a crafted mining.notify request.
Multiple stack-based buffer overflows in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 3.3.0 allow remote pool servers to have unspecified impact via a long URL in a client.reconnect stratum message.
A heap-based buffer overflow in Autodesk SketchBook Pro before version 6.2.6 allows remote attackers to execute arbitrary code via crafted layer bitmap data in a PXD file.
Integer overflow in Autodesk SketchBook Pro before version 6.2.6 allows remote attackers to execute arbitrary code via crafted layer mask data in a PSD file, triggering a heap-based buffer overflow.
The ConvolveHorizontally function in Skia, used in Mozilla Firefox before version 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, does not properly handle the discarding of image data during function execution. This allows remote attackers to execute arbitrary code by triggering prolonged image scaling.
Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allow remote attackers to execute arbitrary code via crafted WebGL content constructed with the Cesium JavaScript library.
A use-after-free vulnerability in the nsDocLoader::OnProgress function in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allows remote attackers to execute arbitrary code via vectors that trigger a FireOnStateChange event.
A use-after-free vulnerability in the FontTableRec destructor in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 on Windows allows remote attackers to execute arbitrary code via crafted use of fonts in MathML content.
Use-after-free vulnerability in the MediaInputPort class in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging incorrect Web Audio control-message ordering.
The mozilla::dom::AudioBufferSourceNodeEngine::CopyFromInputBuffer function in Mozilla Firefox before 31.0 and Thunderbird before 31.0 does not properly allocate Web Audio buffer memory, allowing remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via crafted audio content.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
A use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger certain improper removal of an NSSCertificate structure from a trust domain.