CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2014-2935 concerns a vulnerability in CostView in Caldera 9.20 that allows remote attackers to execute arbitrary commands via shell metacharacters in a methodCall element in a PHP XMLRPC request.
Multiple SQL injection vulnerabilities in Caldera 9.20 allow remote attackers to execute arbitrary SQL commands via the tr parameter to costview2/jobs.php or costview2/printers.php.
Buffer overflow in Cisco Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted .arf file.
Buffer overflow in Cisco Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted .arf file.
A heap-based buffer overflow exists in Cisco WebEx Recording Format (WRF) player that may allow remote attackers to execute arbitrary code or cause application crashes. This affects T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2.
Buffer overflow in Cisco Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted .arf file that triggers improper LZW decompression.
Cisco WebEx Recording Format (WRF) player and Advanced Recording Format (ARF) player in versions T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 are vulnerable to an attack that can cause application crashes. Attackers can exploit specially crafted .wrf or .arf files, leading to a buffer over-read.
The Reverse Proxy feature in IBM Global Security Kit (GSKit) in IBM Security Access Manager (ISAM) before version 7.0.0-ISS-SAM-IF0006 and 8.0 before version 8.0.0.3-ISS-WGA-IF0002 is vulnerable to an attack that can lead to denial of service through an infinite loop caused by crafted SSL messages.
Symantec Critical System Protection (SCSP) before 5.2.9, when installed on an unpatched Windows Server 2003 R2 platform, allows remote attackers to bypass policy settings via unspecified vectors.
The CVE-2014-2913 vulnerability in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe due to an incomplete blacklist. This issue is disputed by multiple parties.
Podatność na przejście do katalogu w pliku actionpack/lib/abstract_controller/base.rb w implementacji implicit-render w Ruby on Rails przed wersją 3.2.18, 4.0.x przed 4.0.5 oraz 4.1.x przed 4.1.1, umożliwia zdalnym atakującym odczyt dowolnych plików poprzez spreparowane żądanie, gdy włączone są określone konfiguracje globbing tras.
Amtelco miSecureMessages version 6.2 does not properly manage sessions, allowing remote authenticated users to obtain sensitive information via a modified message request.
Integer overflow in api.cc in Google V8, used in Google Chrome before version 34.0.1847.131 on Windows and OS X and before version 34.0.1847.132 on Linux, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large length value.
In the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x before 5.5.12, 0666 permissions are used for the UNIX socket, allowing local users to gain privileges via a crafted FastCGI client.
F5 BIG-IQ Cloud and Security versions 4.0.0 through 4.1.0 allow remote authenticated users to change the passwords of arbitrary users via the 'name' parameter in a request to the user's page in mgmt/shared/authz/users/.
CVE-2013-7375 is an SQL injection vulnerability in Authenticate.class.php in PHP-Fusion versions 7.02.01 through 7.02.05. It allows remote attackers to execute arbitrary SQL commands via the user ID in a user cookie.
The setCookieValue function in _lib/functions.global.inc.php in LiveZilla before version 5.1.2.1 allows remote attackers to execute arbitrary PHP code via a serialized PHP object in a cookie.
Multiple SQL injection vulnerabilities in PHP-Fusion before version 7.02.06 allow remote attackers to execute arbitrary SQL commands. Attackers can exploit various parameters in files such as downloads.php, forum/postedit.php, forum/postnewthread.php, and administration/settings_messages.php.
The TCP reassembly function in the inet module in FreeBSD before versions 8.3 p16, 8.4 p9, 9.1 p12, 9.2 p5, and 10.0 p2 allows remote attackers to cause a denial of service (undefined memory access and system crash) or possibly read system memory via multiple crafted packets.
The string_utf_support.rb library in the Arabic Prawn 0.0.1 gem for Ruby has a vulnerability that allows remote attackers to execute arbitrary commands via shell metacharacters in the downloaded_file or url variables.