CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Protected Pages module 7.x-2.x before 7.x-2.4 for Drupal allows remote attackers to bypass the password protection via a crafted path.
Multiple SQL injection vulnerabilities in vldPersonals before version 2.7.1 allow remote attackers to execute arbitrary SQL commands via the (1) country, (2) gender1, or (3) gender2 parameter in a search action to index.php.
Lantronix xPrintServer does not properly restrict access to ips/, allowing remote attackers to execute arbitrary commands via the c parameter in an rpc action.
The DigitalVidhya Digi Online Examination System 2.0 has an unrestricted file upload vulnerability in the photo functionality, allowing remote attackers to execute arbitrary code by uploading a file with an executable extension.
In Advantech EKI-6340 2.05 Wi-Fi Mesh Access Point, a vulnerability in cgi/utility.cgi allows remote authenticated users to execute arbitrary commands via shell metacharacters in the pinghost parameter to ping.cgi.
The DfDiskLo.sys driver in Faronics Deep Freeze Standard and Enterprise 8.10 and earlier allows local administrators to cause a denial of service (crash) and execute arbitrary code via a crafted IOCTL request that writes to arbitrary memory locations.
Aruba Networks ClearPass before 6.3.5 and 6.4.x before 6.4.1 allows remote attackers to execute arbitrary commands via unspecified vectors. This is a different vulnerability than CVE-2014-5342.
Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 does not properly restrict access to unspecified administrative functions, allowing remote attackers to bypass authentication and execute administrative actions via unknown vectors.
The Policy Manager in Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 allows remote authenticated users to gain privileges via unspecified vectors.
Aruba Networks ClearPass before 6.3.5 and 6.4.x before 6.4.1 is vulnerable to remote command execution by attackers via unspecified vectors. This is a different vulnerability than CVE-2014-6627.
Multiple unspecified vulnerabilities in Google Chrome before version 39.0.2171.65 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Multiple integer overflows in the CheckMov function in media/base/container_names.cc in Google Chrome before version 39.0.2171.65 may allow remote attackers to cause a denial of service or possibly have unspecified other impact via a large atom in MPEG-4 or QuickTime .mov data.
Multiple use-after-free vulnerabilities in ScreenOrientationController.cpp in Blink, used in Google Chrome before version 39.0.2171.65, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger improper handling of a detached frame, related to the (1) lock and (2) unlock methods.
A use-after-free vulnerability in the Pepper plugins in Google Chrome before version 39.0.2171.65 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted Flash content that triggers an attempted PepperMediaDeviceManager access outside of the object's lifetime.
Buffer overflow in Skia, as used in Google Chrome before version 39.0.2171.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Buffer overflow in OpenJPEG before r2911 in PDFium, as used in Google Chrome before version 39.0.2171.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted JPEG image.
Use-after-free vulnerability in PDFium, as used in Google Chrome before version 39.0.2171.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document.
Integer overflow in the opj_t2_read_packet_data function in the OpenJPEG library in PDFium, used in Google Chrome before version 39.0.2171.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a long segment in a JPEG image.
A use-after-free vulnerability in the CPDF_Parser::IsLinearizedFile function in PDFium, used in Google Chrome before version 39.0.2171.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document.
Multiple unspecified vulnerabilities in SAP Governance, Risk, and Compliance (GRC) allow remote authenticated users to gain privileges and execute arbitrary programs via a crafted RFC or SOAP-RFC request.