CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A heap-based buffer overflow in Tracker Software PDF-XChange before version 2.5.208 allows remote attackers to execute arbitrary code via a crafted Define Huffman Table header in a JPEG image file stream in a PDF file.
A heap-based buffer overflow in Autodesk SketchBook for Enterprise 2014, Pro, and Express before 6.25, and Copic Edition before 2.0.2 allows remote attackers to execute arbitrary code via RLE-compressed channel data in a PSD file.
Multiple SQL injection vulnerabilities in vTiger CRM versions 5.0.0 through 5.4.0 allow remote attackers to execute arbitrary SQL commands. Attackers can exploit various parameters in SOAP methods to gain access to the database.
The web management interface on Zyxel P660 devices allows remote attackers to cause a denial of service (reboot) via a flood of TCP SYN packets.
The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form.
A race condition in the ath_tx_aggr_sleep function in the Linux kernel before version 3.13.7 allows remote attackers to cause a denial of service (system crash) via a large amount of network traffic that triggers certain list deletions.
Multiple unspecified vulnerabilities in Check Point Security Gateway 80 R71.x before R71.45 and R75.20.x before R75.20.4 and 600 and 1100 appliances R75.20.x before R75.20.42 may lead to unknown impact and attack vectors related to 'important security fixes.'
Session fixation vulnerability in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 allows remote attackers to hijack web sessions via unspecified vectors.
The GUI in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 does not properly validate session-timeout values, which might make it easier for remote attackers to execute arbitrary code by leveraging an unattended workstation.
Directory traversal vulnerability in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 allows remote authenticated users to execute arbitrary code via unspecified vectors.
Apache Commons FileUpload before version 1.3.1 has a vulnerability that allows remote attackers to cause a denial of service via a crafted Content-Type header. This can lead to an infinite loop and high CPU consumption.
Multiple stack-based buffer overflows in ModbusDrv.exe in Schneider Electric Modbus Serial Driver versions 1.10 through 3.2 allow remote attackers to execute arbitrary code via a large buffer-size value in a Modbus Application Header.
Unspecified vulnerability in Sonatype Nexus OSS and Pro versions 2.4.0 through 2.7.1 allows attackers to create arbitrary user accounts via unknown vectors related to 'an unauthenticated execution path.'
Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via various parameters such as news_id, thread_id, user_email in the respective PHP files.
Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via various parameters in PHP scripts.
Unspecified vulnerability in War FTP Daemon (warftpd) 1.82, when running as a Windows service, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors related to log messages and the 'internal log handler to the Windows Event log.'
The Chainfire SuperSU package before version 1.69 for Android allows attackers to gain privileges via the (1) backtick or (2) $() type of shell metacharacters in the -c option to /system/xbin/su.
The CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.3 and 4.4 does not properly restrict the set of users who can execute /system/xbin/su with the --daemon option. This allows attackers to gain privileges by leveraging ADB shell access and a certain Linux UID, and then creating a Trojan horse script.
CVE-2013-6774 describes an untrusted search path vulnerability in the ChainsDD Superuser package 3.1.3 and other versions for Android 4.2.x and earlier. This allows attackers to load an arbitrary .jar file and gain privileges via a crafted BOOTCLASSPATH environment variable for the /system/xbin/su process.
The Superuser package 1.0.2.1 for Android in CyanogenMod/ClockWorkMod/Koush allows attackers to gain privileges via shell metacharacters in the -c option to /system/xbin/su.