CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unspecified vulnerability in the loadFileContents function in the SOAP implementation in HP SiteScope 10.1x, 11.1x, and 11.21 allows remote attackers to read arbitrary files or cause a denial of service via unknown vectors.
SQL injection vulnerability in ATCOM Netvolution 3 allows remote attackers to execute arbitrary SQL commands via the m parameter.
Unspecified vulnerability in Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 allows users to 'breakout' of the shell via unknown vectors.
The Search Everything plugin for WordPress before version 7.0.3 contains an SQL injection vulnerability in the se_search_default function, allowing remote attackers to execute arbitrary SQL commands via the s parameter in index.php.
CVE-2014-1945 is a SQL injection vulnerability in ajax_udf.php in OpenDocMan before version 1.2.7.2 that allows remote attackers to execute arbitrary SQL commands via the add_value parameter.
The Foscam FI8910W camera with firmware before version 11.37.2.55 allows remote attackers to obtain sensitive video and image data via a blank username and password.
Cisco Wireless LAN Controller (WLC) devices 7.2, 7.3, and 7.4 before 7.4.110.0 are vulnerable to an attack that can cause a denial of service by remotely sending a crafted 802.11 Ethernet frame, leading to a device restart.
Cisco Wireless LAN Controller (WLC) devices 7.2 before 7.2.115.2, 7.3, and 7.4 before 7.4.110.0 are vulnerable to an attack that can cause a denial of service through a crafted 802.11 Ethernet frame, leading to a device restart.
The multicast listener discovery (MLD) service on Cisco Wireless LAN Controller (WLC) devices in versions 7.2, 7.3, 7.4 before 7.4.121.0, and 7.5, when MLDv2 Snooping is enabled, allows remote attackers to cause a denial of service (device restart) via a malformed IPv6 MLDv2 packet.
The IGMP implementation on Cisco Wireless LAN Controller devices 4.x, 5.x, 6.x, 7.0 before 7.0.250.0, 7.1, 7.2, and 7.3, when IGMPv3 Snooping is enabled, allows remote attackers to cause a denial of service via a crafted field in an IGMPv3 message.
Cisco Wireless LAN Controller (WLC) devices 7.4 before 7.4.110.0 have a race condition in the status of the administrative HTTP server, allowing remote attackers to bypass intended access restrictions.
Cisco Wireless LAN Controller (WLC) devices 7.0 before 7.0.250.0, 7.2, 7.3, and 7.4 before 7.4.110.0 do not properly deallocate memory, allowing remote attackers to cause a denial of service (reboot) by sending WebAuth login requests at a high rate.
The web management interface on the Cisco RV110W firewall and RV215W and CVR100W routers does not prevent replaying modified authentication requests, allowing remote attackers to gain administrative access.
EMC Documentum TaskSpace versions 6.7SP1 before P25 and 6.7SP2 before P11 improperly handle the interaction between the dm_world group and the dm_superusers_dynamic group. This allows remote authenticated users to obtain sensitive information and gain privileges in opportunistic circumstances.
Unspecified vulnerability in HP Security Management System versions 3.3.0, 3.5.0 before patch 1, and 3.6.0 before patch 2 allows remote attackers to execute arbitrary code via unknown vectors.
A stack-based buffer overflow in GetGo Download Manager versions 4.9.0.1982, 4.8.2.1346, 4.4.5.502 and earlier allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a long HTTP Response Header.
SQL injection vulnerability in Apptha WordPress Video Gallery 2.0, 1.6, and earlier allows remote attackers to execute arbitrary SQL commands via the playid parameter to index.php.
Wiele nieokreślonych podatności w Google V8 przed wersją 3.24.35.10, używanym w Google Chrome przed wersją 33.0.1750.146, może pozwolić atakującym na spowodowanie odmowy usługi lub potencjalnie inny wpływ poprzez nieznane wektory.
Wiele nieokreślonych podatności w Google Chrome przed wersją 33.0.1750.146 może pozwolić atakującym na spowodowanie odmowy usługi lub potencjalnie inne skutki za pomocą nieznanych wektorów.
W funkcji ResourceProvider::InitializeSoftware w Google Chrome przed wersją 33.0.1750.146 występuje przepełnienie bufora oparte na stercie, które może być wykorzystane przez zdalnych atakujących. Wykorzystanie dużego rozmiaru tekstury prowadzi do nieprawidłowej alokacji pamięci w rendererze oprogramowania.