CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers to hijack the authentication of administrators for specific requests, such as changing the administrator password or accessing the database backup functionality.
Buffer overflow in Power Software WinArchiver 3.2 allows remote attackers to execute arbitrary code via a crafted .zip file.
The Festo CECX-X-C1 and CECX-X-M1 Modular Controllers with CoDeSys and SoftMotion do not require authentication for connections to certain TCP ports, allowing remote attackers to modify the configuration or delete log entries.
The Festo CECX-X-C1 and CECX-X-M1 Modular Controllers with CoDeSys and SoftMotion have an undocumented access method via the FTP protocol, which could allow a remote attacker to execute arbitrary code or cause an application crash.
The server in HP Integrated Lights-Out 2 (iLO 2) version 2.23 and earlier allows remote attackers to cause a denial of service via crafted HTTPS traffic.
Multiple SQL injection vulnerabilities in MODX Revolution before version 2.2.14 allow remote attackers to execute arbitrary SQL commands. Attackers can exploit the session ID (PHPSESSID) in index.php or user parameters in connectors/security/message.php and id in manager/index.php.
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier has an issue with handling authentication requests from the remote-user auth plugin. This allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header.
Off-by-one error in the cmd_smart function in the smart self test in QEMU before version 2.0 allows local users to have unspecified impact via a SMART EXECUTE OFFLINE command that triggers a buffer underflow and memory corruption.
In the sfpagent library before version 0.4.15 for Ruby, there is a vulnerability that allows remote attackers to execute arbitrary commands via shell metacharacters in the module name in a JSON request.
The check_secret function in rsync 3.1.0 and earlier allows remote attackers to cause a denial of service via a user name which does not exist in the secrets file, leading to an infinite loop and CPU consumption.
The lib/rrd.php file in Cacti versions 0.8.7g, 0.8.8b, and earlier contains a vulnerability that allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified parameters.
In Django versions before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2, the FilePathField, GenericIPAddressField, and IPAddressField model field classes do not properly perform type conversion. This may allow remote attackers to have unspecified impact related to 'MySQL typecasting.'
The Intel Graphics Driver in Apple OS X through 10.9.2 does not properly validate a certain pointer, allowing attackers to execute arbitrary code via a crafted application.
WindowServer in Apple OS X through 10.9.2 does not prevent session creation by a sandboxed application, allowing attackers to bypass the sandbox protection mechanism and execute arbitrary code via a crafted application.
CVE-2014-2892 involves a heap-based buffer overflow in the get_answer function in mmsh.c in libmms before version 0.6.4. This allows remote attackers to execute arbitrary code via a long line in an MMS over HTTP (MMSH) server response.
SQL injection vulnerability in the get_active_session function in the KTAPI_UserSession class in KnowledgeTree 3.7.0.2 and earlier allows remote attackers to execute arbitrary SQL commands via the u parameter, related to the getFileName function.
Python versions before 3.3.4 RC1 allow remote attackers to cause a denial of service via a file size value larger than the size of the zip file in functions related to reading and extracting zip files.
FitNesse Wiki versions 20131110, 20140201, and earlier allow remote attackers to execute arbitrary commands by defining a COMMAND_PATTERN and TEST_RUNNER in the pageContent parameter when editing a page.
The Network Analysis tab in ASUS RT-AC68U and other RT series routers with firmware before version 3.0.0.4.374.5047 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the Target field (destIP parameter).
The getObjectByToken function in the Pimcore_Tool_Newsletter module in versions 1.4.9 through 2.0.0 does not properly handle objects obtained by unserializing Lucene search data. This allows remote attackers to conduct PHP object injection attacks and execute arbitrary code.