CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The media-file upload feature in GeniXCMS through 0.0.8 allows remote attackers to conduct SSRF attacks via a URL, as demonstrated by a URL with an intranet IP address.
GeniXCMS version 0.0.8 has an SQL injection vulnerability in author.control.php that allows remote attackers to execute arbitrary SQL commands via the type parameter.
CVE-2016-7904 in CMS Made Simple before version 2.1.6 has a cross-site request forgery (CSRF) vulnerability that allows remote attackers to hijack the authentication of administrators for requests that create accounts via an admin/adduser.php request.
A directory traversal vulnerability in inc/files/files.ctrl.php in b2evolution through version 6.8.3 allows remote authenticated users to read or delete arbitrary files by leveraging back-office access to provide a .. (dot dot) in the fm_selected array parameter.
The ms-functions.php file in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, making it easier for remote attackers to bypass intended access restrictions via crafted site or user signups.
A cross-site request forgery (CSRF) vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims for requests that perform a widgets-access action.
The CSRF vulnerability in WordPress before version 4.7.1 allows remote attackers to hijack the authentication of unspecified victims via vectors involving Flash file uploads.
The Linux kernel through version 4.9.3 has a vulnerability that allows local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free) via a crafted application leveraging instruction emulation for fxrstor, fxsave, sgdt, and sidt.
A Directory Traversal vulnerability in CliMonitorReportServlet in Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to read arbitrary files including files with sensitive user information.
A Directory Traversal vulnerability in the SoftwareImageUpload in Brocade Network Advisor versions up to and including 14.0.2 could allow remote attackers to write to arbitrary files, potentially leading to their deletion.
A Directory Traversal vulnerability in DashboardFileReceiveServlet in Brocade Network Advisor versions prior to and including 14.0.2 could allow remote attackers to upload a malicious file in a section of the file system where it can be executed.
A Directory Traversal vulnerability in FileReceiveServlet in Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to upload a malicious file in a section of the file system where it can be executed.
Brocade Virtual Traffic Manager versions prior to and including 11.0 have a CSRF vulnerability that could allow an attacker to trick a logged-in user into making administrative changes on the traffic manager cluster.
Serendipity version 2.0.5 allows CSRF attacks that enable the installation of an event plugin or a sidebar plugin.
The comment.php file in Serendipity versions up to 2.0.5 is vulnerable to CSRF, allowing the deletion of any comments.
CSRF vulnerability in ntopng version 2.4 allows remote attackers to hijack the authentication of arbitrary users. Examples of exploitation include admin/add_user.lua, admin/change_user_prefs.lua, admin/delete_user.lua, and admin/password_reset.lua.
An issue was discovered in the IPv6 protocol related to ICMP Packet Too Big (PTB) messages, affecting all IPv6 implementations from various vendors. An attacker can leverage the generation of IPv6 atomic fragments to trigger fragmentation in arbitrary IPv6 flows, leading to fragmentation-based attacks against legacy IPv6 nodes.
Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template.
The gst_mpegts_section_new function in the mpegts decoder in GStreamer before version 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a too small section.
Off-by-one error in the gst_h264_parse_set_caps function in GStreamer before version 1.10.2 allows remote attackers to have unspecified impact via a crafted file, leading to an out-of-bounds read.