CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The lib/dragonfly/imagemagickutils.rb in the fog-dragonfly gem version 0.8.2 for Ruby has a vulnerability that allows remote attackers to execute arbitrary commands via unspecified vectors.
D-Link DIR-505L SharePort Mobile Companion version 1.01 and DIR-826L Wireless N600 Cloud Router version 1.02 allow remote attackers to bypass authentication via a direct request when an authorized session is active.
Buffer overflow in php-luasandbox in the Scribuntu extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 has unspecified impact and remote vectors.
The raw_cmd_copyin function in the Linux kernel up to version 3.14.3 does not properly handle error conditions during the processing of an FDRAWCMD ioctl call, allowing local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device.
The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands.
Foreman before 1.1 allows remote attackers to execute arbitrary code via a crafted YAML object to the (1) fact or (2) report import API.
The directory manager in Caldera 9.20 allows remote attackers to conduct variable-injection attacks in the global scope via the maindir_hotfolder parameter to dirmng/index.php or an unspecified parameter to other files.
CVE-2014-2935 concerns a vulnerability in CostView in Caldera 9.20 that allows remote attackers to execute arbitrary commands via shell metacharacters in a methodCall element in a PHP XMLRPC request.
Multiple SQL injection vulnerabilities in Caldera 9.20 allow remote attackers to execute arbitrary SQL commands via the tr parameter to costview2/jobs.php or costview2/printers.php.
Buffer overflow in Cisco Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted .arf file.
Buffer overflow in Cisco Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted .arf file.
A heap-based buffer overflow exists in Cisco WebEx Recording Format (WRF) player that may allow remote attackers to execute arbitrary code or cause application crashes. This affects T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2.
Buffer overflow in Cisco Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted .arf file that triggers improper LZW decompression.
Cisco WebEx Recording Format (WRF) player and Advanced Recording Format (ARF) player in versions T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 are vulnerable to an attack that can cause application crashes. Attackers can exploit specially crafted .wrf or .arf files, leading to a buffer over-read.
The Reverse Proxy feature in IBM Global Security Kit (GSKit) in IBM Security Access Manager (ISAM) before version 7.0.0-ISS-SAM-IF0006 and 8.0 before version 8.0.0.3-ISS-WGA-IF0002 is vulnerable to an attack that can lead to denial of service through an infinite loop caused by crafted SSL messages.
Symantec Critical System Protection (SCSP) before 5.2.9, when installed on an unpatched Windows Server 2003 R2 platform, allows remote attackers to bypass policy settings via unspecified vectors.
The CVE-2014-2913 vulnerability in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe due to an incomplete blacklist. This issue is disputed by multiple parties.
Podatność na przejście do katalogu w pliku actionpack/lib/abstract_controller/base.rb w implementacji implicit-render w Ruby on Rails przed wersją 3.2.18, 4.0.x przed 4.0.5 oraz 4.1.x przed 4.1.1, umożliwia zdalnym atakującym odczyt dowolnych plików poprzez spreparowane żądanie, gdy włączone są określone konfiguracje globbing tras.
Amtelco miSecureMessages version 6.2 does not properly manage sessions, allowing remote authenticated users to obtain sensitive information via a modified message request.
Integer overflow in api.cc in Google V8, used in Google Chrome before version 34.0.1847.131 on Windows and OS X and before version 34.0.1847.132 on Linux, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large length value.