CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The App::Context module versions 0.01 through 0.968 for Perl improperly uses the Storable::thaw function, allowing remote attackers to execute arbitrary code via a crafted request to App::Session::Cookie or App::Session::HTMLHidden, which are not properly handled when deserialized.
Multiple SQL injection vulnerabilities in Videos Tube 1.0 allow remote attackers to execute arbitrary SQL commands via the url parameter to (1) videocat.php or (2) single.php.
The Participants Database plugin for WordPress before version 1.5.4.9 has an SQL injection vulnerability in the Export CSV page, allowing remote attackers to execute arbitrary SQL commands.
A stack-based buffer overflow in AccessServer32.exe in Ericom AccessNow Server allows remote attackers to execute arbitrary code via a request for a non-existent file.
ownCloud Server before 6.0.3 does not properly check permissions, allowing remote authenticated users to access other users' contacts via the address book or rename files via unspecified vectors.
PHPDocX, used in ownCloud Server before version 5.0.15 and 6.0.x before version 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
SabreDAV before 1.7.11, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
PHPExcel versions before 1.8.0, used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, do not disable external entity loading in libxml. This allows remote attackers to read arbitrary files, cause denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
getID3() before 1.9.8, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
A vulnerability in the Dell ML6000 and Quantum Scalar i500 systems allows remote attackers to execute arbitrary commands via shell metacharacters in a pathname parameter.
SQL injection vulnerability in the Contextual Related Posts plugin before version 1.8.10.2 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
The default configuration in the Red Hat openstack-neutron package before version 2013.2.3-7 does not properly set a configuration file for rootwrap, allowing remote attackers to gain privileges via a crafted configuration file.
Multiple stack-based buffer overflows in the XML parser in BOINC 7.x allow attackers to have unspecified impact via a crafted XML file, related to the scheduler.
A stack-based buffer overflow in BOINC versions 6.10.58 and 6.12.34 allows remote attackers to exploit it via multiple file_signature elements.
DataLife Engine (DLE) version 9.7 allows remote attackers to execute arbitrary PHP code via the catlist[] parameter to engine/preview.php, which is used in a preg_replace function call with an e modifier.
Symfony versions 2.0.x before 2.0.22, 2.1.x before 2.1.7, and 2.2.x are vulnerable to remote attacks that allow arbitrary PHP code execution via a serialized PHP object in the Yaml::parse or Yaml\Parser::parse functions.
The Yaml::parse function in Symfony 2.0.x before version 2.0.22 allows remote attackers to execute arbitrary PHP code via a PHP file, which is a different vulnerability than CVE-2013-1397.
A stack-based buffer overflow in the do_hnap function in www/my_cgi.cgi in D-Link DSP-W215 (Rev. A1) with firmware 1.01b06 and earlier, DIR-505 with firmware before 1.08b10, and DIR-505L with firmware 1.01 and earlier allows remote attackers to execute arbitrary code via a long Content-Length header in a GetDeviceSettings action in an HNAP request.
SQL injection vulnerability in glossaire-aff.php in the Glossaire module 1.0 for XOOPS allows remote attackers to execute arbitrary SQL commands via the lettre parameter.
SQL injection vulnerability in the Submit_News module for PHP-Nuke 8.3 allows remote attackers to execute arbitrary SQL commands via the topics[] parameter to modules.php.