CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple SQL injection vulnerabilities in NICE Recording eXpress (also known as Cybertech eXpress) version 6.5.7 and earlier allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Heap-based buffer overflow in the StartEpa method in the nsepacom ActiveX control (nsepa.exe) in Citrix Access Gateway Enterprise Edition Plug-in for Windows allows remote attackers to execute arbitrary code via a long CSEC HTTP response header.
Multiple heap-based buffer overflows in Huawei Campus Series Switches S3700HI, S5700, S6700, S3300HI, S5300, S6300, S9300, S7700, and LSW S9700 with software V200R001 before V200R001SPH013, V200R002 before V200R002SPH005, V200R003 before V200R003SPH005, and V200R005 before V200R005C00SPC300 allow remote attackers to cause a denial of service (device restart) via a crafted length field in a packet.
JustSystems JUST Online Update, used in Ichitaro through 2014 and other products, does not properly validate signatures of update modules. This allows remote attackers to spoof modules and execute arbitrary code via a crafted signature.
Cisco IOS XR versions 4.1.2 through 5.1.1 on ASR 9000 devices, when using a Trident-based line card, allow remote attackers to cause a denial of service via malformed IPv6 packets.
Kolibri 2.0 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long URI in a GET request.
Juniper Networks NetScreen Firewall devices with ScreenOS before 6.3r17, when configured to use the internal DNS lookup client, are vulnerable to remote attacks. Attackers can cause a denial of service (crash and reboot) by sending a sequence of malformed packets to the device IP.
Unspecified vulnerability in the Juniper Networks NetScreen Firewall products with ScreenOS before 6.3r17, when configured to use the internal DNS lookup client, allows remote attackers to cause a denial of service (crash and reboot) via vectors related to a DNS lookup.
The av-centerd SOAP service in AlienVault OSSIM before version 4.7.0 allows remote attackers to execute arbitrary commands via crafted requests (1) get_license, (2) get_log_line, or (3) update_system/upgrade_pro_web.
The av-centerd SOAP service in AlienVault OSSIM before version 4.7.0 allows remote attackers to execute arbitrary commands via crafted requests related to system info updates, ossec tasks, and admin_ip or framework_ip settings.
Multiple SQL injection vulnerabilities in the file browser component (we_fs.php) in webEdition CMS before version 6.2.7-s1.2 and 6.3.x through 6.3.8 before -s1 allow remote attackers to execute arbitrary SQL commands via the (1) table or (2) order parameter.
Sharetronix versions 3.1.1.3, 3.1.1, and earlier do not properly restrict access to unspecified AJAX functionality, allowing remote attackers to bypass authentication.
Multiple unspecified vulnerabilities in OpenAL32.dll in JOAL 2.0-rc11 allow context-dependent attackers to execute arbitrary code via crafted parameters in various functions.
A heap-based buffer overflow in paintlib, used in Trimble SketchUp before version 8 Maintenance 3, allows remote attackers to execute arbitrary code via a crafted RLE8 compressed BMP.
Kolibri 2.0 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long URI in a HEAD request.
CVE-2014-4034 is an SQL injection vulnerability in zero_view_article.php in ZeroCMS 1.0 that allows remote attackers to execute arbitrary SQL commands via the article_id parameter.
The userRequest servlet in the Admin Center for Tivoli Storage Manager in Rocket Servergraph allows remote attackers to execute arbitrary commands via various commands such as auth, add, or runAsync.
Samsung iPOLiS Device Manager before version 1.8.7 allows remote attackers to execute arbitrary code via unspecified values in methods such as Start, ChangeControlLocalName, DeleteDeviceProfile, or FrameAdvanceReader in the ActiveX control.
The Dispatch_Write function in DirectFB 1.4.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the Voodoo interface, leading to an out-of-bounds write.
Multiple integer signedness errors in the Dispatch_Write function in DirectFB 1.4.13 may allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the Voodoo interface, leading to a stack-based buffer overflow.