CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2016-8863 describes a heap-based buffer overflow in the create_url_list function in Portable UPnP SDK before version 1.6.21. This vulnerability allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code by sending a valid URI followed by an invalid one in the CALLBACK header of a SUBSCRIBE request.
CVE-2016-7789 is a SQL injection vulnerability in expConfig.php in Exponent CMS version 2.3.9 and earlier. It allows remote attackers to execute arbitrary SQL commands via the apikey parameter.
Exponent CMS versions 2.3.9 and earlier have an SQL injection vulnerability in framework/modules/users/models/user.php that allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVE-2016-7784 is an SQL injection vulnerability in the getSection function in expRouter.php in Exponent CMS version 2.3.9 and earlier. It allows remote attackers to execute arbitrary SQL commands via the section parameter.
CVE-2016-7783 is a SQL injection vulnerability in expRecord.php in Exponent CMS version 2.3.9 and earlier. It allows remote attackers to execute arbitrary SQL commands via the title parameter.
CVE-2016-7782 is an SQL injection vulnerability in expConfig.php in Exponent CMS version 2.3.9 and earlier. It allows remote attackers to execute arbitrary SQL commands via the src parameter.
Exponent CMS versions 2.3.9 and earlier have an SQL injection vulnerability in blogController.php. This allows remote attackers to execute arbitrary SQL commands via the 'author' parameter.
SQL injection vulnerability in cron/find_help.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the version parameter.
Portable UPnP SDK (libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler.
Integer overflow in the amap_alloc1 function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code with kernel privileges via a large size value.
Integer truncation error in the amap_alloc function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code with kernel privileges via a large size value.
Cloudera Manager 5.5 and earlier allows remote attackers to enumerate user sessions via a request to /api/v11/users/sessions.
Cloudera Manager 5.5 and earlier allows remote attackers to obtain sensitive information via a stderr.log or stdout.log value in the filename parameter to /cmf/process/<process_id>/logs.
The camel-snakeyaml component in Apache Camel is vulnerable to a Java object de-serialization vulnerability. De-serializing untrusted data can lead to serious security flaws.
Directory traversal vulnerability in diag.jsp file in CA Unified Infrastructure Management 8.4 SP1 and earlier allows remote attackers to read arbitrary files via unspecified vectors.
The m_authenticate function in nefarious2 allows remote attackers to spoof certificate fingerprints, enabling them to log in as another user via a crafted AUTHENTICATE parameter.
The sys_thrsigdivert function in the OpenBSD kernel 5.9 allows remote attackers to cause a denial of service (panic) by sending a negative 'ts.tv_sec' value.
CVE-2017-6411 affects D-Link DSL-2730U C1 IN_1.00 devices, allowing remote attackers to perform a Cross Site Request Forgery (CSRF) attack. Attackers can change DNS settings, firewall configuration, or any password.
An issue was discovered in sysPass 2.x before 2.1, related to the use of an algorithm that was never sufficiently reviewed by cryptographers. The use of the MCRYPT_RIJNDAEL_256() function instead of MCRYPT_RIJNDAEL_128 may allow an attacker to create unknown havoc in the remote system.
Multiple cross-site request forgery (CSRF) vulnerabilities on the D-Link DI-524 Wireless Router with firmware 9.01 allow remote attackers to change the admin password, reboot the device, or possibly have unspecified other impact via crafted requests to CGI programs.