CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allows remote attackers to execute arbitrary code via shell metacharacters in management functions.
Multiple stack-based buffer overflows on the ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allow man-in-the-middle attackers to execute arbitrary code. This vulnerability can be exploited through various functions processing input data.
The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 has a hardcoded password 'qweasdzxc' for an unspecified account, allowing remote attackers to gain index.asp login access via an HTTP request.
Multiple unrestricted file upload vulnerabilities in fileupload.php in PivotX before 2.3.9 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a .php or .php# extension.
A race condition in the mac80211 subsystem in the Linux kernel before version 3.13.7 allows remote attackers to cause a denial of service (system crash) via network traffic that improperly interacts with the WLAN_STA_PS_STA state (power-save mode).
The Enhanced Web Filtering (EWF) in Juniper Junos before versions 10.4R15, 11.4 before 11.4R9, 12.1 before 12.1R7, 12.1X44 before 12.1X44-D20, 12.1X45 before 12.1X45-D10, and 12.1X46 before 12.1X46-D10, as used in the SRX Series services gateways, allows remote attackers to cause a denial of service (flow daemon crash and restart) via a crafted URL.
Juniper Junos versions 13.2 before 13.2R3 and 13.3 before 13.3R1, when PIM is enabled, allow remote attackers to cause a denial of service (kernel panic and crash) via a large number of crafted IGMP packets.
A stack-based buffer overflow in a certain decryption function in qconnDoor on BlackBerry Z10 devices with software 10.1.0.2312 allows remote attackers to execute arbitrary code via a crafted packet in a TCP session on a wireless network when developer mode has been previously enabled.
A stack-based buffer overflow in WellinTech KingSCADA before version 3.1.2.13 allows remote attackers to execute arbitrary code via a crafted packet.
The BWOCXRUN.BwocxrunCtrl.1 control contains a 'CreateProcess' method that is supposed to validate user-supplied commands. However, this validation can be bypassed, allowing for the execution of arbitrary commands, including remote files.
The BWOCXRUN.BwocxrunCtrl.1 control contains a method named "OpenUrlToBuffer" that takes a URL as a parameter and returns its contents in JavaScript. This method does not validate URLs, allowing access to local files via "file://" URLs.
CVE-2014-0770 allows an attacker to overflow the static stack buffer by providing an overly long string to the UserName parameter. This may enable remote code execution on the target device.
An attacker may pass an overly long value from the AccessCode2 argument to the control, leading to a static stack buffer overflow. As a result, the attacker may remotely execute arbitrary code.
CVE-2014-0767 vulnerability allows an attacker to exploit a static stack buffer overflow by passing an overly long value from the AccessCode argument. This may enable remote code execution on the target device.
CVE-2014-0766 allows an attacker to exploit an overly long NodeName2 argument, leading to a stack buffer overflow. This may enable remote execution of arbitrary code.
CVE-2014-0765 allows an attacker to overflow a static stack buffer by sending an overly long value for the GotoCmd argument. This can lead to remote execution of arbitrary code.
CVE-2014-0764 vulnerability allows an attacker to overflow the static stack buffer by providing an overly long string to the NodeName parameter. This may enable remote code execution on the target device.
An attacker may exploit the SQL injection vulnerability to construct queries without proper sanitization. Functions in DBVisitor.dll, exposed through SOAP interfaces, are vulnerable to SOAP injection, potentially leading to unexpected SQL actions and access to records in the database or execution of arbitrary code.
Multiple unspecified vulnerabilities in J2k-Codec allow remote attackers to execute arbitrary code via a crafted JPEG 2000 file.
The DNP Master Driver in the OSIsoft PI Interface before version 3.1.2.54 for DNP3 allows remote attackers to cause a denial of service (interface shutdown) via a crafted TCP packet.