CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
There is a CSRF vulnerability in markposts.php in Moodle affecting versions 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, and 2.7 through 2.7.13 and earlier. It allows remote attackers to hijack user authentication to mark forum posts as read.
CVE-2016-1161 is a Cross-site request forgery (CSRF) vulnerability in ManageEngine Password Manager Pro before version 8.5 (Build 8500).
The webssx.sys driver in QuickHeal 16.00 allows remote attackers to cause a denial of service.
An Information Exposure issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. Credentials may be exposed to external systems via specific URL parameters.
A Cross-Site Request Forgery issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. An attacker can forge a client request from a different site, allowing access to internal RDP systems on behalf of the currently logged in user.
W bibliotece ARM mbed TLS przed wersjami 1.3.19, 2.x przed 2.1.7 oraz 2.4.x przed 2.4.2 występuje podatność związana z niewłaściwym zwolnieniem wskaźnika stosu podczas analizy certyfikatów x509. Złośliwie skonstruowany certyfikat x509 może prowadzić do potencjalnego zdalnego wykonania kodu.
An exploitable OS Command Injection vulnerability exists in the web application 'ping' functionality of Moxa AWK-3131A Wireless Access Points running firmware 1.1. Specially crafted web form input can cause an OS Command Injection resulting in complete compromise of the vulnerable device.
Twigmo bundled with CS-Cart 4.3.9 and earlier, and Twigmo bundled with CS-Cart Multi-Vendor 4.3.9 and earlier, allows remote authenticated users to execute arbitrary PHP code on the servers.
LINE for Windows before version 4.8.3 allows man-in-the-middle attackers to execute arbitrary code.
CVE-2016-1218 describes an SQL injection vulnerability in Cybozu Garoon before version 4.2.2.
MediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access restrictions by leveraging a call to the UserGetRights function after Session::getAllowedUserRights.
MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, allowing remote attackers to obtain sensitive information via a parse action to api.php.
MediaWiki versions before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, may allow remote attackers to obtain sensitive information by failing to terminate sessions when a user account is blocked.
ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php.
Integer overflow in the Post Office Agent in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 might allow remote attackers to execute arbitrary code via a long username or password, triggering a heap-based buffer overflow.
Red Hat OpenShift Enterprise 2 does not include the HTTPOnly flag in a Set-Cookie header for the GEARID cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies.
Heap-based buffer overflow in IOHIDFamily in Apple iOS before 9.3.2, OS X before 10.11.5, and tvOS before 9.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Multiple heap-based buffer overflows in the CBookBase::SetDefTableStyle and CBookBase::SetDefPivotStyle functions in Hancom Office 2014 VP allow remote attackers to execute arbitrary code via a crafted Hangul Hcell Document (.cell) file.
Cybozu Garoon before 4.2.2 allows remote attackers to bypass login authentication via vectors related to API use.
SquirrelMail version 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a mishandled sendmail.cf file in a popen call. Exploiting this vulnerability enables the execution of arbitrary shell commands on the remote server.