CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Plex Media Server before version 0.9.9.3 allows remote attackers to bypass the web server whitelist, conduct SSRF attacks, and execute arbitrary administrative actions via multiple crafted X-Plex-Url headers to system/proxy, which are inconsistently processed by the request handler in the backend web server.
The EntryPass N5200 Active Network Control Panel allows remote attackers to read device memory and obtain the administrator username and password via a specific URL.
The EntryPass N5200 Active Network Control Panel does not properly restrict access, allowing remote attackers to obtain the administrator username and password, and possibly other sensitive information via a request to /4.
The KDE Clock KCM policykit helper in kde-workspace before 4.11.14 and plasma-desktop before 5.1.1 allows local users to gain privileges via a crafted ntpUtility (ntp utility name) argument.
IBM Tivoli Endpoint Manager MDM before version 9.0.60100 uses the same secret HMAC token across different customers' installations, allowing remote attackers to execute arbitrary code via crafted marshalled Ruby objects in cookies.
EMC Documentum Content Server versions 7.0, 7.1 before 7.1 P10, and 6.7 before SP2 P19 allow remote authenticated users to read or delete arbitrary files via unspecified vectors related to an insecure direct object reference.
The alterSearchQuery function in the CM Downloads Manager plugin for WordPress before version 2.0.4 allows remote attackers to execute arbitrary PHP code via the CMDsearch parameter.
SEIL series routers, including PPP Access Concentrator and Dial-Up Networking, are vulnerable to a denial of service attack that can lead to device restart. Attackers can exploit specially crafted GRE or MPPE packets to trigger this issue.
SEIL Series routers from Internet Initiative Japan Inc. in versions SEIL/X1 2.50 to 4.62, SEIL/X2 2.50 to 4.62, SEIL/B1 2.50 to 4.62, and SEIL/x86 Fuji 1.70 to 3.22 are vulnerable to denial of service attacks. Attackers can exploit a large number of NTP requests in a short time, leading to excessive CPU and traffic consumption.
FUJITSU F-12C, ARROWS Tab LTE F-01D, ARROWS Kiss F-03D, and REGZA Phone T-01D for Android allow local users to execute arbitrary commands via unspecified vectors.
In Lsyncd version 2.1.5 and earlier, the default-rsyncssh.lua script allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.
The hx170dec device driver in Huawei P2-6011 before V100R001C00B043 allows local users to read and write to arbitrary memory locations via unspecified vectors.
The CheckEmail function in includes/functions.class.php in PBBoard 3.0.1 before 20141128 has an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the email parameter on the registration page.
Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to execute arbitrary commands via shell metacharacters in the ping field (setobject_ip parameter).
CVE-2014-3997 describes an SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro and IT360, allowing remote attackers to execute arbitrary SQL commands.
SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central and other ManageEngine products allows remote attackers to execute arbitrary SQL commands via the sv parameter.
Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to execute arbitrary SQL commands.
SQL injection vulnerability in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the probeName parameter.
Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, 11.3, and earlier allows remote attackers to write and execute arbitrary files via a .. (dot dot) in the FILENAME parameter.
CVE-2014-9242 is an SQL injection vulnerability in admin/pages/modify.php in WebsiteBaker 2.8.3 that allows remote attackers to execute arbitrary SQL commands via the page_id parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS