CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain an OS command injection vulnerability. An authenticated attacker can achieve remote code execution by supplying a malicious Wireless parameter to the HTTP PUT NetSDK/Factory SetMAC endpoint.
Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader. An attacker can achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function, which unconditionally calls pickle.loads() on .pkl/.pickle entries and torch.load() with weights_only=False on .pt/.pth entries, executing arbitrary code on every remote worker processing the archive.
An uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (versions 5.4.2 and earlier, 5.5-beta1 and earlier) allows a remote attacker to cause a denial of service through memory exhaustion by sending messages with an excessive number of headers or excessive header length.
SQL Injection vulnerability in Guardian language-system allows an authenticated attacker to inject SQL code via the id parameter in translate_text.php. Lack of input sanitization enables extraction of database contents.
An SQL injection vulnerability in Guardian language-system allows an authenticated attacker to inject malicious SQL via the 'name' GET parameter in designer.php. Unsanitized input enables arbitrary SQL execution and extraction of database contents.
An SQL injection vulnerability in the Guardian language-system allows an authenticated attacker to inject malicious SQL code via the GET parameter 'id' in subtitles.php. Lack of input sanitization enables error-based SQL injection to extract database contents.
An SQL injection vulnerability in Guardian language-system allows an authenticated attacker to inject malicious SQL via the 'id' parameter in job_info_get.php. Unsanitized input enables error-based SQL injection to extract database contents.
An SQL injection vulnerability in the Guardian language-system component allows an authenticated attacker to inject malicious SQL code via the 'id' parameter in text_file.php. Lack of input sanitization enables extraction of database contents.
An SQL injection vulnerability in Guardian language-system allows an authenticated attacker to inject malicious SQL via the id parameter in media.php. Lack of input sanitization enables error-based extraction of database contents.
A vulnerability in the DMG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or other impacts from memory corruption. The issue is due to improper boundary checks in DMG scanning, leading to integer overflow on 32-bit platforms only.
A vulnerability in the ALZ file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or other impacts due to memory corruption. The issue stems from improper boundary checks in ALZ content, leading to an out-of-bounds buffer write.
A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or other impacts due to memory corruption. The issue stems from improper boundary checks in PESpin files during scanning, potentially leading to an out-of-bounds buffer write.
A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This is due to improper handling of temporary resources during file scanning.
A vulnerability in the 7z file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or other impacts due to memory corruption. It is caused by improper boundary checks in 7z files during scanning, leading to an out-of-bounds buffer write.
A vulnerability in the FSG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other impacts from memory corruption, on an affected device. It is due to improper boundary checks for content in FSG files during scanning, which may result in an out-of-bounds buffer write.
A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition due to memory corruption. The issue stems from improper boundary checks in PE files, leading to an out-of-bounds buffer write.
A vulnerability in Cisco Catalyst Center allows an unauthenticated, remote attacker to read arbitrary files from a restricted container. The issue is due to insufficient validation of user-supplied input.
A vulnerability in the Wikimedia Foundation timeline extension affects files scripts/EasyTimeline.Pl and includes/Timeline.Php. The issue impacts versions before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
A vulnerability in MediaWiki allows an unauthorized actor to access sensitive information through API and permission management files.
A vulnerability in NVIDIA Triton Inference Server for Linux allows an attacker to improperly handle highly compressed data. Successful exploitation of this flaw may lead to denial of service (DoS).