CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The TP-Link WR841N V8 router before TL-WR841N(UN)_V8_170210 contained a design flaw in the use of DES for block encryption. This resulted in incorrect access control, allowing attackers to gain read-write access to system settings through the protected router configuration service tddp.
CVE-2017-9848 is a SQL injection vulnerability in C_InfoService.asmx in WebServices in Easysite 7.0. It allows remote attackers to execute arbitrary SQL commands via a crafted ArticleIDs element within an XML document in a GetArticleHitsArray element.
'/cgi-bin/admin/testserver.cgi' of the web service in most VIVOTEK Network Cameras is vulnerable to shell command injection, allowing remote attackers to execute any shell command as root via a crafted HTTP request.
Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries marked as setuid, by setting the CAML_CPLUGINS, CAML_NATIVE_CPLUGINS, or CAML_BYTE_CPLUGINS environment variable.
InsideSecure MatrixSSL 3.8.7b has a heap buffer overflow vulnerability related to X509 certificate parsing. A specially crafted X509 certificate can cause a buffer overflow, leading to remote code execution.
InsideSecure MatrixSSL 3.8.7b has a heap buffer overflow vulnerability related to X509 certificate parsing. A specially crafted X509 certificate can cause a buffer overflow, leading to remote code execution.
In Redgate SQL Monitor before version 3.10 and 4.x before version 4.2, a remote attacker can gain unauthenticated access to the Base Monitor, allowing for the execution of arbitrary SQL commands on monitored Microsoft SQL Server machines.
IdeaBlade Breeze.Server.NET before 1.6.5 allows remote attackers to execute arbitrary code, related to use of TypeNameHandling in JSON deserialization.
A VMSF_DELTA memory corruption was discovered in unrar before 5.5.5, used in Sophos Anti-Virus Threat Detection Engine before 3.37.2, which can lead to arbitrary code execution. An integer overflow in DataSize+CurChannel results in a negative value for the 'DestPos' variable, allowing the attacker to write out of bounds.
The OpenWebif plugin up to version 1.2.4 for E2 devices has a vulnerability that allows unauthorized code execution. The saveConfig function in 'plugin/controllers/models/config.py' performs eval() on the contents of the 'key' HTTP GET parameter.
In EMC Avamar Server Software versions 7.4.1-58, 7.4.0-242, 7.3.1-125, 7.3.0-233, and 7.3.0-226, an unauthorized attacker may leverage the file upload feature of the system maintenance page to load a maliciously crafted file to any directory, which could allow the attacker to execute arbitrary code on the Avamar Server system.
In EMC Avamar Server Software versions 7.3.1-125, 7.3.0-233, 7.3.0-226, 7.2.1-32, 7.2.1-31, 7.2.0-401, an unauthenticated remote attacker may potentially bypass the authentication process to gain access to the system maintenance page. This may be exploited to view sensitive information, perform software updates, or run maintenance workflows.
A SQL Injection issue was discovered in Ecava IntegraXor Versions 5.2.1231.0 and prior. The application fails to properly validate user input, which may allow for an unauthenticated attacker to remotely execute arbitrary code in the form of SQL queries.
The Foscam C1 firmware version 1.9.1.12 contains hard-coded FTP credentials (r:r). Knowledge of these credentials allows remote access to any cameras found on the internet that do not have port 50021 blocked by an intermediate device.
A stack-based buffer overflow vulnerability exists in the web management interface of the Foscam C1 Indoor HD Camera. A specially crafted HTTP request can cause a buffer overflow, resulting in overwriting arbitrary data on the stack frame.
The install/save.php file in WebsiteBaker version 2.10.0 has a vulnerability that allows remote attackers to execute arbitrary PHP code via the database_username, database_host, or database_password parameters.
Adobe Captivate versions 9 and earlier have a remote code execution vulnerability in the quiz reporting feature that could be abused to read and write arbitrary files to the server.
Adobe Digital Editions versions 4.5.4 and earlier contain an insecure library loading vulnerability. This vulnerability is due to unsafe library loading functions in the installer plugin.
Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in the character code mapping module. Successful exploitation could lead to arbitrary code execution.
Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in the PDF parsing engine. Successful exploitation could lead to arbitrary code execution.