CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In Horde_Crypt before 2.7.6, used in Horde Groupware Webmail Edition 5.x through 5.2.17, OS Command Injection can occur if the user has PGP features enabled and has the preference for automatic verification of PGP signed messages enabled. An attacker can send a maliciously crafted PGP signed email to the Horde user, who must then view or preview it.
In Horde_Crypt before 2.7.6, used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated Horde Webmail user, has PGP features enabled in their preferences, and attempts to encrypt an email addressed to a maliciously crafted email address.
D-Link DIR-615 HW: T1 FW:20.09 is vulnerable to Cross-Site Request Forgery (CSRF) attacks. This allows an attacker to perform unwanted actions on a wireless router for which the user/admin is currently authenticated.
An issue (known as XSA-212) was discovered in Xen, affecting versions 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.
A vulnerability in the IntelHAXM.sys driver in Intel Hardware Accelerated Execution Manager before version 6.0.6 allows a local user to gain system level access.
The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism.
In the Linux kernel before version 4.5, there is a vulnerability that allows remote attackers to execute arbitrary code via UDP traffic. This issue occurs during an unsafe second checksum calculation during the execution of a recv system call with the MSG_PEEK flag.
The eCryptfs subsystem in the Linux kernel before version 3.18 allows local users to gain privileges via a large filesystem stack that includes an overlayfs layer.
NixOS 17.03 before version 17.03.887 has a world-writable Docker socket, allowing local users to gain privileges by executing docker commands.
Multiple SQL injection vulnerabilities in account/signup.php and account/signup2.php in WebsiteBaker 2.10.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username, (2) display_name parameter.
BackBox Linux 4.6 allows remote attackers to cause a denial of service (ksoftirqd CPU consumption) via a flood of packets with Martian source IP addresses. The logging of these addresses is enabled by default.
The fill_threshhold_buffer function in base/gxht_thresh.c in Ghostscript 9.20 by Artifex Software, Inc. allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PostScript document.
Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg.
During the installation of Ambari versions 2.4.0 to 2.4.2, Ambari Server artifacts are not created with proper access control lists (ACLs).
Cistron-LG version 1.01 stores sensitive information under the web root with insufficient access controls, allowing remote attackers to obtain IP addresses and other unspecified router credentials.
The default configuration for Cougar-LG stores sensitive information under the web root with insufficient access control, which might allow remote attackers to obtain private ssh keys.
Cougar-LG stores sensitive information under the web root with insufficient access control, allowing remote attackers to obtain credentials.
mrlg-lib.php in mrlg4php before version 1.0.8 allows remote attackers to execute arbitrary shell code.
Technicolor TC7200 with firmware STD6.01.12 could allow remote attackers to obtain sensitive information.
Pulp before version 2.3.0 uses the same certificate authority key and certificate for all installations.