CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Mirror Manager version 0.7.2 and older is vulnerable to remote code execution in the checkin code.
Flask-oidc version 0.1.2 and earlier is vulnerable to an open redirect.
Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl before version 7.50.3 allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow.
Red Hat CloudForms Management Engine 4.1 does not properly handle regular expressions passed to the expression engine via the JSON API and the web-based UI, allowing remote authenticated users to execute arbitrary shell commands.
The makecontext function in the GNU C Library (glibc) before version 2.25 creates execution contexts incompatible with the unwinder on ARM EABI (32-bit) platforms. This may allow context-dependent attackers to cause a denial of service (hang), as demonstrated by applications compiled using gccgo, related to backtrace generation.
The lmadmin component in Flexera FlexNet Publisher before 2015 SP5 and 2016 before R1 SP1, used by Citrix License Server for Windows before 11.14.0.1 and Citrix License Server VPX before 11.14.0.1, allows remote attackers to cause a denial of service (crash) via a type 2F packet with a '01 19' opcode.
The Linux kernel in Red Hat Enterprise Linux 7.2 and Red Hat Enterprise MRG 2, when booted with UEFI Secure Boot enabled, allows local users to bypass intended Secure Boot restrictions and execute untrusted code by appending ACPI tables to the initrd.
The image parser in OpenStack Cinder versions 7.0.2 and 8.0.0 through 8.1.1, Glance before 11.0.1 and 12.0.0, and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service via a crafted disk image.
The exception handling code in Eclipse Jetty before version 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, known as JetLeak.
The Zotpress plugin for WordPress contains an SQL Injection vulnerability in the zp_get_account() function. An attacker can exploit this flaw to execute unauthorized queries against the database.
Huge-IT Catalog v1.0.7 for Joomla is vulnerable to unauthenticated SQL injection, which can be exploited by an attacker to gain access to the database.
The Huge-IT Portfolio Gallery plugin version 1.0.6 contains a vulnerability to unauthenticated SQL Injection, allowing attackers to manipulate database queries.
Huge-IT Video Gallery version 1.0.9 for Joomla is vulnerable to unauthenticated SQL injection, which can be exploited by an attacker to gain access to the database.
Version 1.1.5 of the huge IT gallery for Joomla has identified XSS and SQLi vulnerabilities. An attacker can exploit these flaws to execute malicious code or manipulate database data.
The contus-video-comments plugin version 1.0 for WordPress allows unauthenticated remote .jpg file uploads.
TP-LINK lost control of two domains, www.tplinklogin.net and tplinkextender.net, which are physically printed on many devices.
Version 16.4.1 of Ipswitch WhatsUp Gold is vulnerable to blind SQL injection in the sUniqueID parameter in the WrFreeFormText.asp file.
The WordPress plugin csv2wpec-coupon version 1.1 has a remote file upload vulnerability. An attacker can exploit this flaw to upload malicious files to the server.
Local File Inclusion (LFI) vulnerability in mypixs plugin version 0.3 for WordPress allows an attacker to include local files on the server.
The WordPress plugin Dukapress version 2.5.9 contains a blind SQL injection vulnerability, which may allow attackers to execute unauthorized queries against the database.