CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Podatność w protokole zarządzania klastrem Cisco (CMP) w oprogramowaniu Cisco IOS i Cisco IOS XE może umożliwić nieautoryzowanemu, zdalnemu atakującemu spowodowanie ponownego uruchomienia urządzenia lub zdalne wykonanie kodu z podwyższonymi uprawnieniami. Problem wynika z niewłaściwego przetwarzania opcji Telnet specyficznych dla CMP oraz braku ograniczeń w ich użyciu tylko do lokalnych komunikacji między członkami klastra.
Buffer overflow in Cerberus FTP Server 8.0.10.3 allows remote attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a long MLST command.
The distribute-cache.c file in ImageMagick has an issue with re-using objects after they have been destroyed, which may allow remote attackers to cause unspecified impact.
Pluck CMS version 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature.
Wonder CMS 2014 has a PHP remote file inclusion vulnerability in editInplace.php that allows remote attackers to execute arbitrary PHP code via a URL in the hook parameter.
Directory traversal vulnerability in index.php in Wonder CMS 2014 allows remote attackers to include and execute arbitrary local files via a crafted theme.
readelf in GNU Binutils 2.28 is vulnerable to heap-based buffer over-reads while processing corrupt RL78 binaries. This vulnerability can lead to program crashes and may also result in information leaks.
Hyper-V in Microsoft Windows 10 1607 and Windows Server 2016 does not properly validate vSMB packet data, allowing attackers to execute arbitrary code on a target OS.
Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in PoDoFo allows attackers to have unspecified impact via vectors related to m_offsets.size.
A stack-based buffer overflow vulnerability has been identified in the Fatek Automation PLC Ethernet Module, which may allow remote code execution or crash the affected device. This affects the Ether_cfg software configuration tool running on specific Fatek PLC versions.
A vulnerability in the web-based GUI of Cisco Mobility Express 1800 Series Access Points could allow an unauthenticated, remote attacker to bypass authentication. The attacker could be granted full administrator privileges.
The gnuplot delegate functionality in ImageMagick before version 6.9.4-0 and in GraphicsMagick allows remote attackers to execute arbitrary commands via unspecified vectors.
A stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving WFS get feature requests.
The logcheck function in session.inc in AlienVault OSSIM before 5.3.1 and USM before 5.3.1 allows remote attackers to bypass authentication, consequently obtaining sensitive information, modifying the application, or executing arbitrary code as root via an 'AV Report Scheduler' HTTP User-Agent header.
Sawmill Enterprise version 8.7.9 allows remote attackers to gain login access by leveraging knowledge of a password hash.
Stack-based buffer overflows in php_Easycom5_3_0.dll in EasyCom for PHP 4.0.0.29 allow remote attackers to execute arbitrary code via the server argument to the (1) i5_connect, (2) i5_pconnect, or (3) i5_private_connect API function.
The name_parse function in evdns.c in libevent before version 2.1.6-beta allows remote attackers to have unspecified impact via vectors involving the label_len variable, leading to an out-of-bounds stack read.
An integer underflow in the _gdContributionsAlloc function in the GD Graphics Library (libgd) before version 2.2.4 allows remote attackers to have unspecified impact via manipulation of the u variable.
SQL injection vulnerability in core services in Intel Security McAfee ePolicy Orchestrator (ePO) 5.3.2 and earlier and 5.1.3 and earlier allows attackers to alter a SQL query. This can result in disclosure of information within the database or impersonation of an agent without authentication via a specially crafted HTTP post.
CVE-2014-9921 describes a configuration error in McAfee Cloud Analysis and Deconstructive Services (CADS) 1.0.0.3x, 1.0.0.4d and earlier that allows remote unauthenticated users to view, add, and remove users.