CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A DLL Hijack issue was discovered in Rockwell Automation Connected Components Workbench (CCW). The affected versions include Developer Edition v9.01.00 and earlier, as well as Free Standard Edition v9.01.00 and earlier.
An Authentication Bypass issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. This vulnerability may allow attackers to bypass access control, potentially leading to remote code execution.
An issue with improper neutralization of special elements in OS commands was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. Improper neutralization of these elements may allow an attacker to access root level operating system, potentially leading to remote code execution.
A vulnerability in the web framework of the Cisco TelePresence IX5000 Series could allow an unauthenticated, remote attacker to access arbitrary files on an affected device. The vulnerability is due to insufficient input validation.
A vulnerability in a script file installed as part of the Cisco Policy Suite (CPS) Software distribution could allow an authenticated, local attacker to escalate their privilege level to root. The issue is due to incorrect sudoers permissions on the script file.
A vulnerability in the web interface for Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to bypass authentication and perform command injection with root privileges. The vulnerability is due to missing security constraints in certain HTTP request methods.
A vulnerability in the web interface of Cisco Prime Collaboration Provisioning allows an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks.
A directory traversal vulnerability in the ePO Extension in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, and 5.1.3 and earlier allows remote authenticated users to execute a command of their choice via an authenticated ePO session.
In MODX Revolution before version 2.5.7, a user with file upload permissions can execute arbitrary code by uploading a file named .htaccess.
In MODX Revolution before version 2.5.7, when using PHP 5.3.3, an attacker can include and execute arbitrary files on the web server due to insufficient validation of the action parameter in setup/index.php, leading to a directory traversal attack.
It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker could use this flaw to launch DoS or SSRF attacks, or read files from the server where EAP is deployed.
In WordPress before version 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF vulnerability.
In WordPress before version 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API.
In WordPress before version 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials.
In WordPress before version 4.7.5, there is improper handling of post meta data values in the XML-RPC API.
In libytnef in versions up to 1.9.2, there is a heap-based buffer over-read due to incorrect boundary checking in the SIZECHECK macro in lib/ytnef.c.
An issue, also known as DW201703-001, was discovered in libdwarf in the function dwarf_formsdata(). A few data types were not checked for being in bounds, leading to a heap-based buffer over-read.
An issue was discovered in the libdwarf library that leads to a heap-based buffer over-read. The problem occurs in the _dwarf_decode_s_leb128_chk() function, where a byte pointer is dereferenced before being checked for bounds.
An issue was discovered in libdwarf related to a heap-based buffer over-read in the _dwarf_read_loc_expr_op() function. This problem is due to a failure to check if a pointer is within bounds.
An issue was discovered in the libdwarf library related to a heap-based buffer over-read in the dwarf_formsdata() function. This problem arises from a failure to check if a pointer is in bounds in several places in this function and a failure in a check in the dwarf_attr_list() function.