CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The cartridge_repository.rb in OpenShift Origin and Enterprise versions 1.2.8 through 2.1.1 has a vulnerability that allows remote attackers to execute arbitrary commands via shell metacharacters in a Source-Url ending with a .tar.gz, .zip, .tgz, or .tar file extension in a cartridge manifest file.
Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to tftp/fetch_boot_file.
Multiple stack-based buffer overflows in MinaliC 2.0.0 allow remote attackers to execute arbitrary code. The attack can be performed by manipulating the session_id cookie, directory name, or file name in the respective functions.
A stack-based buffer overflow in the U3D.8BI library plugin in Adobe Photoshop CS5 allows remote attackers to execute arbitrary code via a long Collada asset element in a DAE file.
A stack-based buffer overflow in Ubisoft Rayman Legends before version 1.3.140380 allows remote attackers to execute arbitrary code via a long string sent to TCP port 1001.
An absolute path traversal vulnerability in the webproc cgi module on the Belkin N150 F9K1009 v1 router with firmware before 1.00.08 allows remote attackers to read arbitrary files via a full pathname in the getpage parameter.
Microsoft Internet Explorer versions 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Directory traversal vulnerability in the fndwar web application in HP Executive Scorecard 9.40 and 9.41 allows remote authenticated users to execute arbitrary code, or obtain sensitive information or delete data.
A directory traversal vulnerability in the Content Acceleration Pack (CAP) web application in HP Executive Scorecard versions 9.40 and 9.41 allows remote authenticated users to execute arbitrary code by uploading an executable file.
The Java Glassfish Admin Console in HP Executive Scorecard versions 9.40 and 9.41 does not require authentication, allowing remote attackers to execute arbitrary code via a session on TCP port 10001.
The av-centerd SOAP service in AlienVault OSSIM before version 4.8.0 allows remote attackers to read arbitrary files via a crafted get_file request.
The av-centerd SOAP service in AlienVault OSSIM before version 4.8.0 allows remote attackers to execute arbitrary code via a crafted remote_task request, related to injecting an ssh public key.
The av-centerd SOAP service in AlienVault OSSIM before version 4.8.0 allows remote attackers to create arbitrary files and execute arbitrary code via a crafted set_file request.
Directory traversal vulnerability in iPrint in Novell Open Enterprise Server (OES) 11 SP1 before Maintenance Update 9151 on Linux has unspecified impact and remote attack vectors.
The libpcap file parser in Wireshark 1.10.x before 1.10.4 contains a vulnerability that allows remote attackers to execute arbitrary code or cause application crashes via a crafted packet-trace file that includes a large packet.
CVE-2013-6221 in HP Service Virtualization 3.x before version 3.50.1, when the AutoPass license server is enabled, has a directory traversal vulnerability. This allows remote attackers to create arbitrary files and execute arbitrary code.
CVE-2014-4307 is an SQL injection vulnerability in categories-x.php in WebTitan before version 4.04, allowing remote attackers to execute arbitrary SQL commands via the sortkey parameter.
Multiple SQL injection vulnerabilities in NICE Recording eXpress (also known as Cybertech eXpress) version 6.5.7 and earlier allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Heap-based buffer overflow in the StartEpa method in the nsepacom ActiveX control (nsepa.exe) in Citrix Access Gateway Enterprise Edition Plug-in for Windows allows remote attackers to execute arbitrary code via a long CSEC HTTP response header.
Multiple heap-based buffer overflows in Huawei Campus Series Switches S3700HI, S5700, S6700, S3300HI, S5300, S6300, S9300, S7700, and LSW S9700 with software V200R001 before V200R001SPH013, V200R002 before V200R002SPH005, V200R003 before V200R003SPH005, and V200R005 before V200R005C00SPC300 allow remote attackers to cause a denial of service (device restart) via a crafted length field in a packet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS