CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The simple-image-manipulator WordPress plugin version 1.0 has a vulnerability that allows remote file download.
The WordPress plugin google-adsense-and-hotel-booking version 1.05 contains an open proxy, which may lead to unauthorized access to system resources.
There is a remote file download vulnerability in wptf-image-gallery version 1.03.
The WordPress plugin recent-backups version 0.7 has a vulnerability that allows remote file downloads.
The 'candidate-application-form' WordPress plugin version 1.0 has a vulnerability that allows remote file downloads.
CVE-2015-1000003 affects the filedownload plugin version 1.4 for WordPress, which is vulnerable to Blind SQL Injection. An attacker can exploit this vulnerability to execute unauthorized database queries.
The filedownload plugin version 1.4 for WordPress contains an open proxy, which may lead to unauthorized access to resources.
The fast-image-adder plugin version 1.1 for WordPress has a vulnerability that allows remote file uploads.
The vulnerability allows remote file uploads in the mailcwp plugin version 1.99 for WordPress.
The audit_plugin component in MariaDB in Pivotal Cloud Foundry (PCF) cf-mysql-release 27 and 28 allows remote attackers to obtain sensitive information by reading syslog messages, potentially exposing cleartext credentials.
Cisco Firepower Management Center version 6.0.1 has hardcoded database credentials, allowing local users to obtain sensitive information via CLI access.
The Threat Management Console in Cisco Firepower Management Center versions 5.2.0 through 6.0.1 allows remote authenticated users to execute arbitrary commands via crafted web-application parameters.
Cisco IOS XR version 6.1.1 allows local users to execute arbitrary OS commands as root by leveraging admin privileges.
A CSRF vulnerability in Cisco Unified Intelligence Center (CUIC) versions 8.5.4 through 9.1(1) allows remote attackers to hijack the authentication of arbitrary users. This also affects Unified Contact Center Express versions 10.0(1) through 11.0(1).
Cisco IOS 12.2(33)SXJ9 on Supervisor Engine 32 and 720 modules for 6500 and 7600 devices mishandles certain operators, flags, and keywords in TCAM share ACLs, allowing remote attackers to bypass intended access restrictions.
Directory traversal vulnerability in the Configuration Manager in IBM Sterling Secure Proxy (SSP) 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 allows remote attackers to read arbitrary files via a crafted URL.
Buffer overflow in the Overlay Transport Virtualization (OTV) GRE feature in Cisco NX-OS 5.0 through 7.3 on Nexus 7000 and 7700 devices allows remote attackers to execute arbitrary code via long parameters in a packet header.
A vulnerability in Cisco NX-OS from versions 4.1 to 7.3 and from 11.0 to 11.2 on Nexus 2000, 3000, 3500, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows remote attackers to cause a device crash by sending malformed IPv4 DHCP packets to the DHCPv4 relay agent.
A vulnerability in Cisco NX-OS from versions 4.0 to 7.3 on Multilayer Director and Nexus devices allows remote authenticated users to bypass intended AAA restrictions and gain privileged CLI access via crafted parameters in an SSH connection negotiation.
A vulnerability in Cisco NX-OS from versions 4.1 to 7.3 and from 11.0 to 11.2 on Nexus 2000, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows remote attackers to cause a denial of service (device crash) via crafted IPv4 DHCP packets sent to the DHCPv4 relay agent or smart relay agent.