CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Microsoft Internet Explorer versions 6 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, known as 'Internet Explorer Memory Corruption Vulnerability.'
A vulnerability in Microsoft Windows SharePoint Services and various versions of SharePoint and Project Server allows remote authenticated users to execute arbitrary code via crafted page content.
Dpkg version 1.15.9 on Debian squeeze introduces support for the 'C-style encoded filenames' feature without recognizing that the squeeze patch program lacks this feature. This leads to an interaction error that allows remote attackers to conduct directory traversal attacks and modify files outside of the intended directories via a crafted source package.
rxvt-unicode before 9.20 does not properly handle OSC escape sequences, allowing user-assisted remote attackers to manipulate arbitrary X window properties and execute arbitrary commands.
Unspecified vulnerability in OpenJDK 6 before version 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS. This vulnerability has unknown impact and attack vectors, differing from CVE-2014-0462.
The web interface 1.1 on Broadcom Ltd PIPA C211 rev2 has a vulnerability that improperly restricts access to cgi-bin/rpcBridge. This allows remote attackers to obtain credentials and other sensitive information or modify the firmware.
An integer signedness error in Android Debug Bridge (ADB) version 4.4 allows ADB servers to execute arbitrary code via a negative length value, bypassing a signed comparison and triggering a stack-based buffer overflow.
Foscam IP camera version 11.37.2.49 and others, when using the Foscam DynDNS option, generates credentials based on predictable camera subdomain names. This allows remote attackers to spoof or hijack arbitrary cameras and conduct other attacks by modifying arbitrary camera records in the Foscam DNS server.
Unspecified vulnerability in OpenJDK 6 before version 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS may have unknown impact and attack vectors.
The drupalauth module before 1.2.2 for simpleSAMLphp allows remote attackers to authenticate as an arbitrary user via the user name (uid) in a cookie.
Multiple SQL injection vulnerabilities in LCG Disk Pool Manager (DPM) before version 1.8.6 allow remote attackers to execute arbitrary SQL commands. Attackers can exploit various variables in functions related to request and entry management.
The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, and other versions allows remote administrators to execute arbitrary commands via shell metacharacters in the hostname element in a SOAP request.
MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 does not properly sanitize SVG files, allowing remote attackers to have unspecified impact via invalid XML.
The lib/dragonfly/imagemagickutils.rb in the fog-dragonfly gem version 0.8.2 for Ruby has a vulnerability that allows remote attackers to execute arbitrary commands via unspecified vectors.
D-Link DIR-505L SharePort Mobile Companion version 1.01 and DIR-826L Wireless N600 Cloud Router version 1.02 allow remote attackers to bypass authentication via a direct request when an authorized session is active.
Buffer overflow in php-luasandbox in the Scribuntu extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 has unspecified impact and remote vectors.
The raw_cmd_copyin function in the Linux kernel up to version 3.14.3 does not properly handle error conditions during the processing of an FDRAWCMD ioctl call, allowing local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device.
The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands.
Foreman before 1.1 allows remote attackers to execute arbitrary code via a crafted YAML object to the (1) fact or (2) report import API.
The directory manager in Caldera 9.20 allows remote attackers to conduct variable-injection attacks in the global scope via the maindir_hotfolder parameter to dirmng/index.php or an unspecified parameter to other files.