CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
EMC Documentum Content Server before version 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to conduct DQL injection attacks, enabling them to bypass intended restrictions on database actions.
EMC Documentum Content Server versions before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allow remote authenticated users to execute arbitrary commands via shell metacharacters in arguments to unspecified methods.
EMC Documentum Content Server before version 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to obtain super-user privileges for system-object creation and bypass intended restrictions on data access and server actions.
Funkcja futex_requeue w jądrze Linux do wersji 3.14.5 nie zapewnia, że wywołania mają dwa różne adresy futex, co pozwala lokalnym użytkownikom na uzyskanie uprawnień poprzez spreparowane polecenie FUTEX_REQUEUE, które umożliwia niebezpieczną modyfikację oczekujących.
Multiple unspecified vulnerabilities in Libav before version 0.8.12 may allow remote attackers to achieve unknown impact and vectors.
Multiple array index errors in the MyHeritage SEQueryObject ActiveX control (SearchEngineQuery.dll) version 1.0.2.0 allow remote attackers to execute arbitrary code. These issues affect various parameters of methods such as AddTokens, AddLastNameTokens, and AddMultipleSearches.
The standard universe shadow (condor_shadow.std) component in Condor 7.7.3 through 7.7.6, 7.8.0 before 7.8.5, and 7.9.0 does not properly check privileges, allowing remote attackers to gain privileges via a crafted standard universe job.
The thumbnail proxy server in EMC Documentum Digital Asset Manager (DAM) versions 6.5 SP3, 6.5 SP4, 6.5 SP5, and 6.5 SP6 before P13 is vulnerable to DQL injection attacks. Remote attackers can exploit a crafted parameter in a query string to bypass intended restrictions on querying objects.
OpenSSL versions before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h do not properly restrict processing of ChangeCipherSpec messages. This allows man-in-the-middle attackers to trigger the use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, potentially hijacking sessions or obtaining sensitive information.
Xen 4.4.x running on ARM systems does not properly check write permissions on virtual addresses, allowing local guest administrators to gain privileges via unspecified vectors.
The asn1_get_bit_der function in GNU Libtasn1 before version 3.6 does not properly report an error when a negative bit length is identified, allowing context-dependent attackers to cause out-of-bounds access via crafted ASN.1 data.
Radio Thermostat CT80 and CT50 with firmware 1.4.64 and earlier does not restrict access to the API, allowing remote attackers to change the operation mode, wifi connection settings, temperature thresholds, and other settings.
Corel PaintShop Pro X5 and X6 has an untrusted search path vulnerability that allows local users to execute arbitrary code and conduct DLL hijacking attacks. This affects versions 16.0.0.113, 15.2.0.2, and earlier.
Multiple SQL injection vulnerabilities in FrontAccounting (FA) before version 2.3.21 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
A stack-based buffer overflow in the FindConfigChildeKeyList method in the XNSSDKDEVICE.XnsSdkDeviceCtrlForIpInstaller.1 ActiveX control in Samsung iPOLiS Device Manager before version 1.8.7 allows remote attackers to execute arbitrary code via a long value.
The DNP3 NG driver in COPA-DATA zenon versions 7.10 and 7.11, as well as the DNP3 Process Gateway in version 7.11 SP0 and earlier, allow remote attackers to cause a denial of service by sending a crafted DNP3 packet over TCP, leading to an infinite loop and process crash.
The ATEN CN8000 remote-access unit with firmware 1.6.154 and earlier allows remote attackers to cause a denial of service via unspecified vectors.
ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 is vulnerable to an LDAP injection attack that can be conducted by remote attackers via unspecified vectors, as demonstrated using a 'login query.'
The Spoon module version 0.24 for Perl improperly uses the Storable::thaw function, allowing remote attackers to execute arbitrary code via a crafted request that is not properly handled during deserialization.
The HTML::EP module version 0.2011 for Perl improperly uses the Storable::thaw function in Session::Cookie, allowing remote attackers to execute arbitrary code via a crafted request that is not properly handled during deserialization.