CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unspecified vulnerability in Piwigo before version 2.6.3 has unknown impact and attack vectors, related to a 'security failure.'
Unspecified vulnerability in HP Release Control 9.x before version 9.13 p3 and 9.2x before version RC 9.21.0003 p1 on Windows and 9.2x before version RC 9.21.0002 p1 on Linux, allowing remote authenticated users to gain privileges via unknown vectors.
SQL injection vulnerability in superlinks.php in the superlinks plugin 1.4-2 for Cacti allows remote attackers to execute arbitrary SQL commands via the id parameter.
Unspecified vulnerability in IBM Security Access Manager (ISAM) for Mobile 8.0 and IBM Security Access Manager for Web 7.0 and 8.0 allows remote attackers to execute arbitrary code via unknown vectors.
The Local Management Interface (LMI) in IBM Security Access Manager (ISAM) for Mobile 8.0 with firmware 8.0.0.0 through 8.0.0.3 and IBM Security Access Manager for Web 7.0 and 8.0 with firmware 8.0.0.2 and 8.0.0.3 allows remote attackers to bypass authentication via a login action with invalid credentials.
A stack-based buffer overflow in FreeFloat FTP Server 1.0 allows remote authenticated users to execute arbitrary code via a long string in a PUT command.
The cartridge_repository.rb in OpenShift Origin and Enterprise versions 1.2.8 through 2.1.1 has a vulnerability that allows remote attackers to execute arbitrary commands via shell metacharacters in a Source-Url ending with a .tar.gz, .zip, .tgz, or .tar file extension in a cartridge manifest file.
Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to tftp/fetch_boot_file.
Multiple stack-based buffer overflows in MinaliC 2.0.0 allow remote attackers to execute arbitrary code. The attack can be performed by manipulating the session_id cookie, directory name, or file name in the respective functions.
A stack-based buffer overflow in the U3D.8BI library plugin in Adobe Photoshop CS5 allows remote attackers to execute arbitrary code via a long Collada asset element in a DAE file.
A stack-based buffer overflow in Ubisoft Rayman Legends before version 1.3.140380 allows remote attackers to execute arbitrary code via a long string sent to TCP port 1001.
An absolute path traversal vulnerability in the webproc cgi module on the Belkin N150 F9K1009 v1 router with firmware before 1.00.08 allows remote attackers to read arbitrary files via a full pathname in the getpage parameter.
Microsoft Internet Explorer versions 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Directory traversal vulnerability in the fndwar web application in HP Executive Scorecard 9.40 and 9.41 allows remote authenticated users to execute arbitrary code, or obtain sensitive information or delete data.
A directory traversal vulnerability in the Content Acceleration Pack (CAP) web application in HP Executive Scorecard versions 9.40 and 9.41 allows remote authenticated users to execute arbitrary code by uploading an executable file.
The Java Glassfish Admin Console in HP Executive Scorecard versions 9.40 and 9.41 does not require authentication, allowing remote attackers to execute arbitrary code via a session on TCP port 10001.
The av-centerd SOAP service in AlienVault OSSIM before version 4.8.0 allows remote attackers to read arbitrary files via a crafted get_file request.
The av-centerd SOAP service in AlienVault OSSIM before version 4.8.0 allows remote attackers to execute arbitrary code via a crafted remote_task request, related to injecting an ssh public key.
The av-centerd SOAP service in AlienVault OSSIM before version 4.8.0 allows remote attackers to create arbitrary files and execute arbitrary code via a crafted set_file request.
SNMPConfig.php in the management console in Symantec Web Gateway (SWG) before version 5.2.1 allows remote attackers to execute arbitrary commands via unspecified vectors.