CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Exponent CMS 2.4 uses PHP reflection to call methods of a controller class, leading to issues with user permission verification. Due to case insensitivity in method names, an attacker can bypass permission checks by using appropriately capitalized method names.
Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.
A stack buffer overflow in the send.exe and receive.exe components of Micro Focus Rumba 9.4 and earlier could be exploited by local attackers or attackers able to inject arguments to these binaries to execute code.
A vulnerability in the Slowpath of StarOS for Cisco ASR 5500 Series routers with Data Processing Card 2 (DPC2) could allow an unauthenticated, remote attacker to cause a subset of the subscriber sessions to be disconnected, resulting in a partial denial of service (DoS) condition. This affects Cisco ASR 5500 devices with DPC2 running StarOS 18.0 or later.
A vulnerability in the web framework code of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary SQL commands on the database.
A vulnerability in the web-based graphical user interface of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication. The attacker could be granted full administrator privileges.
A vulnerability in the SDP parser of Cisco Meeting Server could allow an unauthenticated, remote attacker to execute arbitrary code on an affected system. This affects versions prior to 2.0.3 and Acano Server versions 1.9.x prior to 1.9.5 and 1.8.x prior to 1.8.17.
A vulnerability in Cisco Meeting Server and Meeting App could allow an unauthenticated, remote attacker to execute arbitrary code on an affected system. This affects versions of Cisco Meeting Server prior to 2.0.1 and other listed applications.
A vulnerability in the Transaction Language 1 (TL1) code of Cisco ASR 900 Series routers could allow an unauthenticated, remote attacker to cause a reload of, or remotely execute code on, the affected system.
A vulnerability in the command-line interface of the Cisco IP Interoperability and Collaboration System (IPICS) could allow an authenticated, local attacker to elevate the privilege level associated with their session.
MuJS before version a0ceaf5050faf419401fe1b83acfa950ec8a8a89 by Artifex Software, Inc. allows context-dependent attackers to obtain sensitive information by using a crafted JavaScript approach, related to a 'Buffer Over-read' issue.
Exponent CMS version 2.3.9 suffers from a SQL injection vulnerability in '/framework/modules/help/controllers/helpController.php' affecting the version parameter. The impact is Information Disclosure.
Exponent CMS version 2.3.9 suffers from a SQL injection vulnerability in '/expPaginator.php' affecting the 'order' parameter.
The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 is vulnerable to an SQL Injection attack.
The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 could be used to upload a malicious file to any folder on the site via a directory traversal attack.
SAP ASE version 16.0 SP02 PL03 and prior allows attackers who own SourceDB and TargetDB databases to elevate privileges to sa (system administrator) via dbcc import_sproc SQL injection.
A vulnerability on Samsung Mobile M (6.0) devices exists due to improper restriction of external access to SystemUI activities, leading to a SystemUI crash and device restart.
Exponent CMS versions before 2.3.9 are vulnerable to an attacker uploading a malicious script file via redirection, allowing the script to be placed in an unprotected folder that permits script execution.
git-fastclone before 1.0.5 passes user modifiable strings directly to a shell command. An attacker can execute malicious commands by modifying the strings that are passed as arguments to 'cd ' and 'git clone ' commands.
CVE-2015-8968 vulnerability in git-fastclone before version 1.0.1 allows arbitrary shell command execution from .gitmodules. An attacker can instruct a user to run a recursive clone from a repository they control, enabling the execution of malicious code.