CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Wibu-Systems CodeMeter Runtime before version 5.20 uses weak permissions (read and write access for all users) for codemeter.exe, allowing local users to gain privileges via a Trojan horse file.
The WinCC server in Siemens SIMATIC WinCC versions 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 versions 7.1 through SP4, 8.0 through SP2, and 8.1; and TIA Portal 13 before Update 6 allows remote attackers to execute arbitrary code via crafted packets.
An unspecified vulnerability in JustSystems Ichitaro 2008-2014 allows remote attackers to execute arbitrary code via a crafted file.
Adobe Flash Player w wersjach przed 13.0.0.258 oraz 14.x i 15.x przed 15.0.0.239 na systemach Windows i OS X, a także przed 11.2.202.424 na Linuxie, oraz Adobe AIR przed 15.0.0.293, Adobe AIR SDK przed 15.0.0.302 i Adobe AIR SDK & Compiler przed 15.0.0.302, umożliwiają atakującym wykonanie dowolnego kodu lub spowodowanie odmowy usługi (nieważne odwołanie do wskaźnika) poprzez nieokreślone wektory.
Use-after-free vulnerability in decode_slice.cpp in Cisco OpenH264 1.2.0 and earlier allows remote attackers to execute arbitrary code via an encoded media file.
Buffer overflow in decode.cpp in Cisco OpenH264 1.2.0 and earlier allows remote attackers to execute arbitrary code via an encoded media file.
The ConfigSaveServlet servlet in ManageEngine OpUtils before build 71024 allows remote attackers to disclose files via a crafted filename, related to 'saveFile'.
The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before version 7.2 SP2, SonicWALL Analyzer before version 7.2 SP2, and SonicWALL UMA before version 7.2 SP2 allows remote authenticated users to execute arbitrary code via unspecified vectors.
The web interface in Aruba Networks AirWave before version 7.7.14 and 8.x before version 8.0.5 allows remote authenticated users to gain privileges and execute arbitrary commands via unspecified vectors.
CVE-2014-8367 is an SQL injection vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) versions 6.2.x, 6.3.x before 6.3.6, and 6.4.x before 6.4.2, allowing remote attackers to execute arbitrary SQL commands.
Mountall version 1.54, used in Ubuntu 14.10, does not properly handle the umask when using the mount utility, allowing local users to bypass intended access restrictions.
The do_mmu_update function in arch/x86/mm.c in Xen versions 3.2.x through 4.4.x does not properly manage page references, allowing remote domains to cause a denial of service by leveraging control over an HVM guest and a crafted MMU_MACHPHYS_UPDATE.
The DB dialplan function in Asterisk Open Source before versions 1.8.32, 11.1.4.1, 12.7.1, and 13.0.1, and Certified Asterisk before versions 1.8.28-cert8 and 11.6-cert8 allows remote authenticated users to gain privileges via a call from an external protocol, as demonstrated by the AMI protocol.
The res_pjsip_acl module in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 does not properly create and load ACLs defined in pjsip.conf at startup, allowing remote attackers to bypass intended PJSIP ACL rules.
The generate_password function in Moodle through 2.4.11, and in versions 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide a sufficient number of possible temporary passwords, allowing remote attackers to gain access via a brute-force attack.
Buffer overflow in Cybozu Office 9 and 10 before 10.1.0, Mailwise 4 and 5 before 5.1.4, and Dezie 8 before 8.1.1 allows remote authenticated users to execute arbitrary code via e-mail messages.
A stack-based buffer overflow in the date_from_ISO8601 function in PHP before version 5.2.7 can be exploited by remote attackers. Including a timezone field in a date leads to improper XML-RPC encoding, potentially causing application crashes or arbitrary code execution.
Multiple SQL injection vulnerabilities in Gogs (Go Git Service) versions 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter in the api/v1/repos/search and api/v1/users/search endpoints.
In Gogs (Go Git Service) versions 0.3.1-9 through 0.5.6.x before 0.5.6.1025 Beta, there is an SQL injection vulnerability in the GetIssues function. Remote attackers can execute arbitrary SQL commands via the label parameter to user/repos/issues.
A stack-based buffer overflow in Advantech WebAccess, formerly BroadWin WebAccess, allows remote attackers to execute arbitrary code via a crafted ip_address parameter in an HTML document.