CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Datum Systems SnIP on PSM-500 and PSM-4500 devices does not require authentication for FTP sessions, allowing remote attackers to obtain sensitive information via RETR commands.
The WP Rss Poster plugin version 1.0.0 for WordPress has an SQL injection vulnerability. Remote attackers can execute arbitrary SQL commands via the id parameter on the wrp-add-new page in the admin panel.
Juniper Junos versions before 11.4R12, 12.1R10, 12.1X44-D35, 12.1X45-D25, 12.1X46-D20, 12.1X47-D10, 12.2R8, 12.3R7, 13.1R4, 13.2R4, 13.3R2, and 14.1R1 with Auto-RP enabled are vulnerable to an attack that can cause a denial of service (RDP routing process crash and restart) via a malformed PIM packet.
On SRX Series devices running Juniper Junos versions before 11.4R12, 12.1X44 before 12.1X44-D32, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, and 12.1X47 before 12.1X47-D10, enabled NAT protocol translation from IPv4 to IPv6 may allow remote attackers to cause a denial of service (flowd hang or crash) via a crafted packet.
Juniper Junos versions before 11.4R12, 12.1R11, 12.1X44-D35, 12.1X45-D30, 12.1X46-D20, 12.1X47-D10, 12.2R8-S2, 12.3R7, 13.1R4-S2, 13.2R5, 13.3R2-S2, and 14.1R1 allow remote authenticated users to gain privileges via unspecified combinations of CLI commands and arguments.
A vulnerability in Juniper Junos 12.1X46 before version 12.1X46-D20 and 12.1X47 before version 12.1X47-D10 on SRX Series devices allows remote attackers to cause a denial of service (flowd crash) via a crafted SIP packet.
Dahua DVR versions 2.608.0000.0 and 2.608.GV00.0 allow remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions.
Docker version 1.0.0 uses world-readable and world-writable permissions on the management socket, allowing local users to gain privileges via unspecified vectors.
SQL injection vulnerability in admin/uploads.php in AtomCMS, possibly version 2.0, allows remote attackers to execute arbitrary SQL commands via the id parameter.
SQL injection vulnerability in index.php in FoeCMS allows remote attackers to execute arbitrary SQL commands via the i parameter.
A stack-based buffer overflow exists in BKFSim_vhfd.exe in Yokogawa CENTUM CS 1000, CENTUM CS 3000, CENTUM VP, Exaopc, and B/M9000 systems. This allows remote attackers to execute arbitrary code via a crafted packet when the FCS/Test Function is enabled.
Multiple cross-site scripting (XSS) vulnerabilities in osTicket before 1.9.2 allow remote attackers to inject arbitrary web script or HTML via the Phone Number field in open.php or the passwd1, passwd2 fields and do parameter in account.php.
CVE-2014-4741 describes an SQL injection vulnerability in Artifectx xClassified 1.2 in the demo/ads.php file, allowing remote attackers to execute arbitrary SQL commands via the catid parameter.
ZeroCMS 1.0 has an SQL injection vulnerability in zero_transact_article.php that allows remote attackers to execute arbitrary SQL commands via the article_id parameter in a Submit Comment action.
A heap-based buffer overflow in the xjpegls.dll format plugin in XnView 1.99 and 1.99.1 allows remote attackers to execute arbitrary code via a crafted JLS image file.
The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization. This allows remote attackers to execute arbitrary code via a crafted string that triggers use of a Hashtable destructor, related to 'type confusion' issues in ArrayObject and SPLObjectStorage.
Adobe Flash Player and Adobe AIR in specific versions allow attackers to bypass intended access restrictions via unspecified vectors. This is a different vulnerability than CVE-2014-0537.
Adobe Flash Player and Adobe AIR prior to specified versions contain a vulnerability that allows attackers to bypass intended access restrictions. This issue affects various platforms, including Windows, OS X, and Linux.
Microsoft Internet Explorer versions 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a different vulnerability than CVE-2014-2786 and CVE-2014-2792.
Microsoft Internet Explorer versions 6 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a different vulnerability than CVE-2014-2800 and CVE-2014-2807.