CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Citrix CloudPlatform (formerly Citrix CloudStack) 3.0.x before 3.0.6 Patch C does not properly restrict access to VNC ports on the management network, allowing remote attackers to have unspecified impact.
The uploadFile function in upload/index.php in CosCMS before version 1.822 allows remote administrators to execute arbitrary commands via shell metacharacters in the name of an uploaded file.
GetPermissions.asp in Cogent Real-Time Systems Cogent DataHub before version 7.3.5 allows remote attackers to execute arbitrary commands via unspecified vectors.
A heap-based buffer overflow in the Web Server in Cogent DataHub before version 7.3.5 allows remote attackers to execute arbitrary code by sending a negative value in the Content-Length field in a request.
Hanvon FaceID before 1.007.110 does not require authentication, allowing remote attackers to modify access-control and attendance-tracking data via API commands.
libgadu before 1.11.4 and 1.12.0 before 1.12.0-rc3, as used in Pidgin and other products, allows remote Gadu-Gadu file relay servers to cause a denial of service (memory overwrite) or possibly execute arbitrary code via a crafted message.
A use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript code that improperly interacts with a CollectGarbage function call on a CMarkup object.
The default keybindings for wwm in LTSP Display Manager (ldm) versions 2.2.x before 2.2.7 allow remote attackers to execute arbitrary commands via the KP_RETURN keybinding, which launches a terminal window.
An integer underflow in the LCodeGen::PrepareKeyedOperand function in Google V8 before version 3.25.28.16 allows remote attackers to cause a denial of service or possibly have unspecified other impact.
Multiple unspecified vulnerabilities in Google Chrome before version 35.0.1916.114 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
A use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before version 35.0.1916.114, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger removal of an SVGFontFaceElement object.
Integer overflow in the AudioInputRendererHost::OnCreateStream function in Google Chrome before version 35.0.1916.114 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a large shared-memory allocation.
A use-after-free vulnerability in the StyleElement::removedFromDocument function in Blink, used in Google Chrome before version 35.0.1916.114, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted JavaScript code that triggers tree mutation.
Easy File Sharing (EFS) Web Server 6.8 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long string in a cookie UserID parameter to vfolder.ghp.
Buffer overflow in the 'read-u8vector!' procedure in the srfi-4 unit in CHICKEN stable 4.8.0.7 and development snapshots before 4.9.1 allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly execute arbitrary code via a '#f' value in the NUM argument.
CVE-2014-3749 describes an SQL injection vulnerability in Construtiva CIS Manager that allows remote attackers to execute arbitrary SQL commands via the email parameter in autenticar/lembrarlogin.asp.
Unspecified vulnerability in Juniper Junos Space before version 13.3R1.8 that allows remote attackers to execute arbitrary commands when the firewall is disabled.
x2gocleansessions in X2Go Server before version 4.0.0.8 and 4.0.1.x before version 4.0.1.10 allows remote authenticated users to gain privileges via unspecified vectors, possibly related to backticks.
The GetGUID function in codecs/dmp4.dll in RealNetworks RealPlayer 16.0.3.51 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via a malformed .3gp file.
SQL injection vulnerability in the LiveData service in CSWorks before version 2.5.5233.0 allows remote attackers to execute arbitrary SQL commands via vectors related to pathnames contained in web API requests.