CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The AMF3CD_AddProp function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to execute arbitrary code.
A buffer underflow vulnerability exists in the Debian inspircd package before version 2.0.5-1+deb7u1 for wheezy and before version 2.0.16-1 for jessie and sid. This issue arises from an incomplete fix of CVE-2012-1836.
The 'Smart related articles' extension version 1.1 for Joomla! has an SQL injection vulnerability in dialog.php. An attacker must use the search_cats variable in the POST method to exploit this vulnerability.
An issue was discovered in api/includes/systems.php in Unitrends Enterprise Backup before version 9.0.0. User input is not properly filtered before being sent to a popen function, allowing for remote code execution.
An unprivileged user of the Unitrends Enterprise Backup before version 9.0.0 can escalate to root privileges by modifying the 'token' cookie issued at login.
SQL injection vulnerability in the mgr.login.php file in Ktools.net Photostore before version 4.7.5 allows remote attackers to execute arbitrary SQL commands via the email parameter in a recover_login action.
Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an action_on_quick_icon action to item.query.php or the (2) order or (3) direction parameter in an (a) connections_logs, (b) errors_logs or (c) access_logs action to view.query.php.
Buffer overflow in Apache Tomcat Connectors (mod_jk) before version 1.2.42.
In SolarWinds Log & Event Manager (LEM) before version 6.3.1 Hotfix 4, accessing the menu system via the SSH service with default credentials 'cmc' and 'password' allows an attacker to exploit a vulnerability in the restrictssh feature. This enables the attacker to escape from the restricted shell.
The Spider Event Calendar plugin before version 1.5.52 for WordPress has an SQL injection vulnerability that can be exploited via the order_by parameter in calendar_functions.php or widget_Theme_functions.php.
Adobe Flash Player versions 25.0.0.127 and earlier have an exploitable use after free vulnerability in the ActionScript2 NetStream class. Successful exploitation could lead to arbitrary code execution.
Adobe Flash Player versions 25.0.0.127 and earlier have an exploitable use after free vulnerability in ActionScript2 when creating a getter/setter property. Successful exploitation could lead to arbitrary code execution.
Adobe Flash Player versions 25.0.0.127 and earlier have an exploitable memory corruption vulnerability in the SWF parser. Successful exploitation could lead to arbitrary code execution.
Adobe Flash Player versions 25.0.0.127 and earlier have an exploitable memory corruption vulnerability in the ActionScript2 code parser. Successful exploitation could lead to arbitrary code execution.
Adobe Flash Player versions 25.0.0.127 and earlier have an exploitable use after free vulnerability in the internal script object. Successful exploitation could lead to arbitrary code execution.
Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, and 15.023.20070 and earlier have an exploitable memory corruption vulnerability in the JavaScript engine. Successful exploitation could lead to arbitrary code execution.
Adobe Campaign versions up to Build 8770 have an input validation bypass that could be exploited to read, write, or delete data from the Campaign database.
Certain Brother devices have an authorization issue that involves including a valid AuthCookie cookie in the HTTP response to a failed login attempt.
The Trend Micro Threat Discovery Appliance 2.6.1062r1 has a directory traversal vulnerability that allows a remote, unauthenticated attacker to delete arbitrary files as root by processing a session_id cookie. This can be exploited to bypass authentication or cause a DoS.
A command execution flaw exists in the Trend Micro Threat Discovery Appliance 2.6.1062r1 with the timezone parameter in the admin_sys_time.cgi interface.