CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Samsung Magician version 5.0 fails to validate TLS certificates for HTTPS software update traffic. Prior to version 5.0, Samsung Magician used HTTP for software updates.
Multiple SQL injection vulnerabilities in GLPI 0.90.4 allow an authenticated remote attacker to execute arbitrary SQL commands by using a certain character when the database is configured to use Big5 encoding.
An Improper Privilege Management issue was discovered in Cambium Networks ePMP. The privileges for SNMP community strings are not properly restricted, which may allow an attacker to gain access to sensitive information and possibly allow for configuration changes.
A SQL Injection issue was discovered in Ecava IntegraXor Versions 5.2.1231.0 and prior. The application fails to properly validate user input, which may allow for an unauthenticated attacker to remotely execute arbitrary code in the form of SQL queries.
An Information Exposure issue was discovered in Trihedral VTScada Versions prior to 11.2.26. Some files are exposed within the web server application to unauthenticated users, which may contain sensitive configuration information.
A Resource Consumption issue was discovered in Trihedral VTScada Versions prior to 11.2.26. The client does not properly validate the input or limit the amount of resources that are utilized by an attacker, which can be used to consume more resources than are available.
An exploitable integer overflow vulnerability exists in the JPEG 2000 parser functionality of IrfanView 4.44. A specially crafted jpeg2000 image can cause an integer overflow leading to wrong memory allocation resulting in arbitrary code execution.
The Foscam C1 firmware version 1.9.1.12 contains hard-coded FTP credentials (r:r). Knowledge of these credentials allows remote access to any cameras found on the internet that do not have port 50021 blocked by an intermediate device.
A Remote Code Execution vulnerability was found in Horde_Image 2.x before 2.5.0 via a crafted GET request. Exploitation requires authentication.
In Flatpak before 0.8.7, third-party app repositories could include malicious apps with files having inappropriate permissions, such as setuid or world-writable. These files could be executed by a local attacker or allow writing to world-writable locations.
A buffer overflow vulnerability exists in the web management interface of the Foscam C1 Indoor HD Camera that can be exploited by an attacker. A specially crafted HTTP request can cause a buffer overflow, resulting in overwriting arbitrary data.
A buffer overflow vulnerability exists in the web management interface of the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can cause a buffer overflow resulting in overwriting arbitrary data.
A command injection vulnerability exists in the web management interface of the Foscam C1 Indoor HD Camera that can be exploited by an attacker. A specially crafted HTTP request allows for the injection of arbitrary shell characters during account creation.
A command injection vulnerability exists in the web management interface of the Foscam C1 Indoor HD Camera. A specially crafted HTTP request allows an attacker to inject arbitrary shell characters during account creation.
A stack-based buffer overflow vulnerability exists in the web management interface of the Foscam C1 Indoor HD Camera. A specially crafted HTTP request can cause a buffer overflow, resulting in overwriting arbitrary data on the stack frame.
The install/save.php file in WebsiteBaker version 2.10.0 has a vulnerability that allows remote attackers to execute arbitrary PHP code via the database_username, database_host, or database_password parameters.
In Wireshark 2.2.7, PROFINET IO data with a high recursion depth allows remote attackers to cause a denial of service (stack exhaustion) in the dissect_IODWriteReq function.
Adobe Captivate versions 9 and earlier have a remote code execution vulnerability in the quiz reporting feature that could be abused to read and write arbitrary files to the server.
Adobe Digital Editions versions 4.5.4 and earlier contain an insecure library loading vulnerability. This vulnerability is due to unsafe library loading functions in the installer plugin.
Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in the character code mapping module. Successful exploitation could lead to arbitrary code execution.