CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and delete files with the permissions of DiskFileItem. Additionally, if running on a Java VM before 1.3.1, it can execute arbitrary code via a crafted serialized Java object.
In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. This could lead to leakage of potentially confidential information and a segfault in other cases resulting in denial of service.
IBM BigFix Inventory v9.2 uses inadequate account lockout settings that could allow a remote attacker to brute force account credentials.
In install/page_dbsettings.php in the Core distribution of XOOPS 2.5.8.1, unfiltered data passed to CREATE and ALTER SQL queries caused SQL Injection in the database settings page.
CVE-2017-4053 is a Command Injection vulnerability in the web interface of McAfee Advanced Threat Defense (ATD) versions 3.10, 3.8, 3.6, and 3.4. It allows remote unauthenticated users or attackers to execute arbitrary commands via a crafted HTTP request parameter.
CVE-2017-4052 is an authentication bypass vulnerability in the web interface of McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4. Remote unauthenticated users can change or update configuration settings and gain administrator functionality via a crafted HTTP request parameter.
phpMyFAQ before 2.9.8 does not properly mitigate brute-force attacks that try many passwords in attempted logins quickly.
FineCMS version 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager 'Add Site' action to enter this code after a ', sequence in a domain name.
A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 allows an attacker to log out active sessions of other users. This issue is related to how it tracks sessions and allows an unauthenticated attacker to view and terminate active sessions from other users.
Podatność CVE-2017-11165 dotyczy urządzenia dataTaker DT80 dEX w wersji 1.50.012, które pozwala zdalnym atakującym na uzyskanie wrażliwych informacji o poświadczeniach i konfiguracji poprzez bezpośrednie żądanie do URI /services/getFile.cmd?userfile=config.xml.
A vulnerability in Windows allows remote code execution due to improper handling of objects in memory by Windows Search. This affects multiple versions of Windows operating systems, including Windows 7, 8.1, and Windows 10.
On iSmartAlarm cube devices, there is an authentication bypass leading to remote execution of commands, such as setting the alarm on/off, related to incorrect cryptography.
In Apache Impala versions 2.7.0 to 2.8.0, a vulnerability was identified that allows a malicious process to impersonate an Impala daemon. This can lead to skipping authentication checks when Kerberos is enabled but TLS is not used.
NfSen before 1.3.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the customfmt parameter (aka the 'Custom output format' field).
Wtyczka Struts 1 w Apache Struts w wersjach 2.1.x i 2.3.x może umożliwiać zdalne wykonanie kodu poprzez złośliwą wartość pola przekazaną w surowej wiadomości do ActionMessage.
In PHP before 5.6.30 and 7.x before 7.0.15, attackers could exploit the PHAR archive handler by supplying malicious archive files, potentially causing the PHP interpreter to crash or disclosing information due to a buffer over-read in the phar_parse_pharfile function.
GraphicsMagick version 1.3.26 has double free vulnerabilities in the ReadOneJNGImage() function in coders/png.c.
The libxar.so library in version 1.6.1 has a NULL pointer dereference in the xar_get_path function in util.c.
The libxar.so library in version 1.6.1 has a NULL pointer dereference in the xar_unserialize function in archive.c.
EMC ESRS Policy Manager prior to 6.8 contains an undocumented account (OpenDS admin) with a default password. A remote attacker with the knowledge of the default password may login to the system and gain administrator privileges to the local LDAP directory server.