CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.24)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
XnView Classic version 2.40 for Windows allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file.
This vulnerability allows local attackers to escalate privileges on Jungo WinDriver 12.4.0 and earlier. The issue exists within the processing of IOCTL 0x953824b7 by the windrvr1240 kernel driver, where user-supplied data is not properly validated, potentially leading to a kernel pool overflow.
This vulnerability allows local attackers to escalate privileges on Jungo WinDriver 12.4.0 and earlier. The issue exists within the processing of IOCTL 0x953824a7 by the windrvr1240 kernel driver, where user-supplied data is not properly validated.
Multiple SQL injection vulnerabilities in the User Dashboard module 7.x before 7.x-1.4 for Drupal allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Blue Coat Malware Analysis Appliance (MAA) before version 4.2.5 and Malware Analyzer G2 allow remote attackers to bypass a virtual machine protection mechanism, potentially leading to writing to arbitrary files, causing denial of service (host reboot or reset to factory defaults), or executing arbitrary code.
Kura before version 2.1.0 has a vulnerability that allows taking control over the device's firewall configuration, but does not allow setting IPv6 firewall rules. The Equinox console port 5002 remains open, allowing login to Kura without user credentials over unencrypted telnet and executing commands as 'root'.
EE 4GEE WiFi MBB devices (before version EE60_00_05.00_31) allow remote attackers to obtain sensitive information via a JSONP endpoint, potentially exposing passwords and SMS content.
EE 4GEE WiFi MBB devices (before version EE60_00_05.00_31) have a CSRF vulnerability related to the goform/AddNewProfile, goform/setWanDisconnect, goform/setSMSAutoRedirectSetting, goform/setReset, and goform/uploadBackupSettings functions.
A stack-based buffer overflow was discovered in xtrans_interpolate in internal/dcraw_common.cpp in LibRaw before version 0.18.3. It could allow a remote denial of service or code execution attack.
Honeywell NVR devices allow remote attackers to create user accounts in the admin group by leveraging access to a guest account to obtain a session ID. The attacker can then send that session ID in a userManager.addUser request to the /RPC2 URI.
On Samsung NVR devices, remote attackers can read the MD5 password hash of the 'admin' account via certain szUserName JSON data to cgi-bin/main-cgi, and login to the device with that hash in the szUserPasswd parameter.
The SDK in Bento4 version 1.5.0-616 has a Read Memory Access Violation vulnerability in the AP4_StszAtom class. This vulnerability can be exploited by opening a crafted .MP4 file.
In the SDK in Bento4 version 1.5.0-616, there is a memory access violation vulnerability in the AP4_StssAtom class. This vulnerability can be exploited to execute arbitrary code by opening a crafted .MP4 file.
The SDK in Bento4 version 1.5.0-616 has a memory access violation vulnerability in the AP4_StscAtom class. This vulnerability can be exploited to execute arbitrary code by opening a crafted .MP4 file.
The SDK in Bento4 version 1.5.0-616 has a Write Memory Access Violation vulnerability in the SetItemCount function in the Core/Ap4StscAtom.h file. This vulnerability can be exploited to execute arbitrary code by opening a crafted .MP4 file.
The SDK in Bento4 version 1.5.0-616 has a Read Memory Access Violation vulnerability in the AP4_AtomSampleTable::GetSample function. This vulnerability can be exploited by opening a crafted .MP4 file.
SQL Injection exists in the EyesOfNetwork web interface (aka eonweb) 5.1-0 via the group_id cookie to side.php.
Unrestricted File Upload vulnerability in the fileDenyPattern in TYPO3 from versions 7.6.0 to 7.6.21 and from 8.0.0 to 8.7.4 allows remote authenticated users to upload files with a .pht extension, consequently executing arbitrary PHP code.
SQL Injection exists in the EyesOfNetwork web interface (eonweb) 5.1-0 via the user_id cookie to header.php.
CVE-2017-14242 is an SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 that allows remote attackers to execute arbitrary SQL commands via the statut parameter.