CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Winmail Server 6.1 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php move_folder_file call to move a .php file from the FTP folder into a web folder.
Boa 0.94.14rc21 has a vulnerability that allows the injection of '../..' using the FILECAMERA variable (sent by GET), enabling the reading of files with root privileges.
'/cgi-bin/admin/downloadMedias.cgi' of the web service in most VIVOTEK Network Cameras is vulnerable, allowing remote attackers to read any file on the camera's Linux filesystem via a crafted HTTP request containing '..' sequences.
'/cgi-bin/admin/testserver.cgi' of the web service in most VIVOTEK Network Cameras is vulnerable to shell command injection, allowing remote attackers to execute any shell command as root via a crafted HTTP request.
Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries marked as setuid, by setting the CAML_CPLUGINS, CAML_NATIVE_CPLUGINS, or CAML_BYTE_CPLUGINS environment variable.
IBM Sterling B2B Integrator Standard Edition version 5.2 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.
Integer overflow leading to heap buffer overflow in JBIG2Stream.cc in pdftocairo in Poppler before version 0.56 allows remote attackers to cause application crashes or possibly have unspecified other impacts via a crafted PDF document.
InsideSecure MatrixSSL 3.8.7b has a heap buffer overflow vulnerability related to X509 certificate parsing. A specially crafted X509 certificate can cause a buffer overflow, leading to remote code execution.
InsideSecure MatrixSSL 3.8.7b has a heap buffer overflow vulnerability related to X509 certificate parsing. A specially crafted X509 certificate can cause a buffer overflow, leading to remote code execution.
ExpressionEngine versions 2.x < 2.11.8 and 3.x < 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution.
In Redgate SQL Monitor before version 3.10 and 4.x before version 4.2, a remote attacker can gain unauthenticated access to the Base Monitor, allowing for the execution of arbitrary SQL commands on monitored Microsoft SQL Server machines.
IdeaBlade Breeze.Server.NET before 1.6.5 allows remote attackers to execute arbitrary code, related to use of TypeNameHandling in JSON deserialization.
A buffer overflow in Smart Card authentication code in gpkcsp.dll in Microsoft Windows XP through SP3 and Server 2003 through SP2 allows a remote attacker to execute arbitrary code on the target computer, provided that the computer is joined in a Windows domain and has Remote Desktop Protocol connectivity (or Terminal Services) enabled.
Vulnerability in the Solaris component of Oracle Sun Systems Products Suite, affecting the kernel, allows a low privileged attacker to take control of the Solaris system. Affected versions are 10 and 11.
A VMSF_DELTA memory corruption was discovered in unrar before 5.5.5, used in Sophos Anti-Virus Threat Detection Engine before 3.37.2, which can lead to arbitrary code execution. An integer overflow in DataSize+CurChannel results in a negative value for the 'DestPos' variable, allowing the attacker to write out of bounds.
The OpenWebif plugin up to version 1.2.4 for E2 devices has a vulnerability that allows unauthorized code execution. The saveConfig function in 'plugin/controllers/models/config.py' performs eval() on the contents of the 'key' HTTP GET parameter.
In EMC Avamar Server Software versions 7.4.1-58, 7.4.0-242, 7.3.1-125, 7.3.0-233, and 7.3.0-226, an unauthorized attacker may leverage the file upload feature of the system maintenance page to load a maliciously crafted file to any directory, which could allow the attacker to execute arbitrary code on the Avamar Server system.
In EMC Avamar Server Software versions 7.3.1-125, 7.3.0-233, 7.3.0-226, 7.2.1-32, 7.2.1-31, 7.2.0-401, an unauthenticated remote attacker may potentially bypass the authentication process to gain access to the system maintenance page. This may be exploited to view sensitive information, perform software updates, or run maintenance workflows.
EMC Isilon OneFS versions 8.0.1.0, 8.0.0 - 8.0.0.3, 7.2.0 - 7.2.1.4, and 7.1.x are affected by a privilege escalation vulnerability that could potentially be exploited by attackers to compromise the affected system.
Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Downloaded updates are only verified using a server-provided MD5 hash.