CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Directory traversal vulnerability in valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to enumerate files on the system via the var_url parameter in a valider_xml action.
A CSRF vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that execute the XML validator on a local file via a crafted valider_xml request.
A heap-based buffer overflow in the Fp_toString function in jsfunction.c in Artifex Software MuJS can lead to a denial of service (crash) via crafted input.
The chartorune function in Artifex Software MuJS allows attackers to cause a denial of service (out-of-bounds read) via a * (asterisk) at the end of the input.
The m_authenticate function in UnrealIRCd before 3.2.10.7 and 4.x before 4.0.6 allows remote attackers to spoof certificate fingerprints, enabling them to log in as another user via a crafted AUTHENTICATE parameter.
Integer overflow in the BMP coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (crash) via crafted height and width values, which triggers an out-of-bounds write.
The SmartCall Activity component in the Telecom application on Samsung Note devices L(5.0/5.1) and M(6.0) allows attackers to cause a denial of service (crash and reboot) or possibly gain privileges via a malformed serializable object.
The SpamCall Activity component in Telecom application on Samsung Note device L (5.0/5.1) and M (6.0) allows attackers to cause a denial of service (crash and reboot) or possibly gain privileges via a malformed serializable object.
A stack-based buffer overflow in the inbound_cap_ls function in common/inbound.c in HexChat 2.10.2 allows remote IRC servers to cause a denial of service (crash) by sending a large number of options in a CAP LS message.
Directory traversal vulnerability in the client in HexChat 2.11.0 allows remote IRC servers to read or modify arbitrary files via a .. (dot dot) in the server name.
An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
CVE-2014-9909 describes an elevation of privilege vulnerability in the Broadcom Wi-Fi driver that could allow a local malicious application to execute arbitrary code within the kernel context. This issue is rated as High because it requires compromising a privileged process first.
Na urządzeniach NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900 i R8000 występuje problem z ujawnieniem hasła poprzez specjalnie skonstruowane żądania do serwera zarządzania siecią. W przypadku wyłączonej opcji odzyskiwania hasła, użytkownik może uzyskać dostęp do hasła administratora routera.
The media rename feature in GeniXCMS through version 0.0.8 does not consider alternative PHP file extensions when checking uploaded files for PHP content. This allows a user to rename and execute files with the `.php6`, `.php7`, and `.phtml` extensions.
GeniXCMS version 0.0.8 has an SQL injection vulnerability in Posts.class.php that allows remote attackers to execute arbitrary SQL commands via the id parameter.
The media-file upload feature in GeniXCMS through 0.0.8 allows remote attackers to conduct SSRF attacks via a URL, as demonstrated by a URL with an intranet IP address.
GeniXCMS version 0.0.8 has an SQL injection vulnerability in author.control.php that allows remote attackers to execute arbitrary SQL commands via the type parameter.
CVE-2016-7904 in CMS Made Simple before version 2.1.6 has a cross-site request forgery (CSRF) vulnerability that allows remote attackers to hijack the authentication of administrators for requests that create accounts via an admin/adduser.php request.
A directory traversal vulnerability in inc/files/files.ctrl.php in b2evolution through version 6.8.3 allows remote authenticated users to read or delete arbitrary files by leveraging back-office access to provide a .. (dot dot) in the fm_selected array parameter.
The ms-functions.php file in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, making it easier for remote attackers to bypass intended access restrictions via crafted site or user signups.