CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Directory traversal vulnerability in iPrint in Novell Open Enterprise Server (OES) 11 SP1 before Maintenance Update 9151 on Linux has unspecified impact and remote attack vectors.
The libpcap file parser in Wireshark 1.10.x before 1.10.4 contains a vulnerability that allows remote attackers to execute arbitrary code or cause application crashes via a crafted packet-trace file that includes a large packet.
CVE-2013-6221 in HP Service Virtualization 3.x before version 3.50.1, when the AutoPass license server is enabled, has a directory traversal vulnerability. This allows remote attackers to create arbitrary files and execute arbitrary code.
CVE-2014-4307 is an SQL injection vulnerability in categories-x.php in WebTitan before version 4.04, allowing remote attackers to execute arbitrary SQL commands via the sortkey parameter.
Multiple SQL injection vulnerabilities in NICE Recording eXpress (also known as Cybertech eXpress) version 6.5.7 and earlier allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Heap-based buffer overflow in the StartEpa method in the nsepacom ActiveX control (nsepa.exe) in Citrix Access Gateway Enterprise Edition Plug-in for Windows allows remote attackers to execute arbitrary code via a long CSEC HTTP response header.
Multiple heap-based buffer overflows in Huawei Campus Series Switches S3700HI, S5700, S6700, S3300HI, S5300, S6300, S9300, S7700, and LSW S9700 with software V200R001 before V200R001SPH013, V200R002 before V200R002SPH005, V200R003 before V200R003SPH005, and V200R005 before V200R005C00SPC300 allow remote attackers to cause a denial of service (device restart) via a crafted length field in a packet.
JustSystems JUST Online Update, used in Ichitaro through 2014 and other products, does not properly validate signatures of update modules. This allows remote attackers to spoof modules and execute arbitrary code via a crafted signature.
Cisco IOS XR versions 4.1.2 through 5.1.1 on ASR 9000 devices, when using a Trident-based line card, allow remote attackers to cause a denial of service via malformed IPv6 packets.
Kolibri 2.0 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long URI in a GET request.
Juniper Networks NetScreen Firewall devices with ScreenOS before 6.3r17, when configured to use the internal DNS lookup client, are vulnerable to remote attacks. Attackers can cause a denial of service (crash and reboot) by sending a sequence of malformed packets to the device IP.
Unspecified vulnerability in the Juniper Networks NetScreen Firewall products with ScreenOS before 6.3r17, when configured to use the internal DNS lookup client, allows remote attackers to cause a denial of service (crash and reboot) via vectors related to a DNS lookup.
The av-centerd SOAP service in AlienVault OSSIM before version 4.7.0 allows remote attackers to execute arbitrary commands via crafted requests (1) get_license, (2) get_log_line, or (3) update_system/upgrade_pro_web.
The av-centerd SOAP service in AlienVault OSSIM before version 4.7.0 allows remote attackers to execute arbitrary commands via crafted requests related to system info updates, ossec tasks, and admin_ip or framework_ip settings.
Multiple SQL injection vulnerabilities in the file browser component (we_fs.php) in webEdition CMS before version 6.2.7-s1.2 and 6.3.x through 6.3.8 before -s1 allow remote attackers to execute arbitrary SQL commands via the (1) table or (2) order parameter.
Sharetronix versions 3.1.1.3, 3.1.1, and earlier do not properly restrict access to unspecified AJAX functionality, allowing remote attackers to bypass authentication.
Multiple unspecified vulnerabilities in OpenAL32.dll in JOAL 2.0-rc11 allow context-dependent attackers to execute arbitrary code via crafted parameters in various functions.
A heap-based buffer overflow in paintlib, used in Trimble SketchUp before version 8 Maintenance 3, allows remote attackers to execute arbitrary code via a crafted RLE8 compressed BMP.
Kolibri 2.0 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long URI in a HEAD request.
CVE-2014-4034 is an SQL injection vulnerability in zero_view_article.php in ZeroCMS 1.0 that allows remote attackers to execute arbitrary SQL commands via the article_id parameter.