CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An issue was discovered in Tableau Server versions 7.0 to 10.1.3 and Wonderware Intelligence versions 2014R3 and prior related to a default system account. This account is difficult to configure with non-default credentials after installation, and changing the default credentials is not documented.
Exponent CMS versions 2.3.9 and earlier have an SQL injection vulnerability in filedownloadController.php. This allows remote attackers to execute arbitrary SQL commands via the fileid parameter.
CVE-2016-9020 is a SQL injection vulnerability in helpController.php in Exponent CMS version 2.3.9 and earlier. It allows remote attackers to execute arbitrary SQL commands via the version parameter.
CVE-2016-9019 is an SQL injection vulnerability in the activate_address function in addressController.php in Exponent CMS version 2.3.9 and earlier. It allows remote attackers to execute arbitrary SQL commands via the is_what parameter.
CVE-2016-8863 describes a heap-based buffer overflow in the create_url_list function in Portable UPnP SDK before version 1.6.21. This vulnerability allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code by sending a valid URI followed by an invalid one in the CALLBACK header of a SUBSCRIBE request.
CVE-2016-7789 is a SQL injection vulnerability in expConfig.php in Exponent CMS version 2.3.9 and earlier. It allows remote attackers to execute arbitrary SQL commands via the apikey parameter.
Exponent CMS versions 2.3.9 and earlier have an SQL injection vulnerability in framework/modules/users/models/user.php that allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVE-2016-7784 is an SQL injection vulnerability in the getSection function in expRouter.php in Exponent CMS version 2.3.9 and earlier. It allows remote attackers to execute arbitrary SQL commands via the section parameter.
CVE-2016-7783 is a SQL injection vulnerability in expRecord.php in Exponent CMS version 2.3.9 and earlier. It allows remote attackers to execute arbitrary SQL commands via the title parameter.
CVE-2016-7782 is an SQL injection vulnerability in expConfig.php in Exponent CMS version 2.3.9 and earlier. It allows remote attackers to execute arbitrary SQL commands via the src parameter.
Exponent CMS versions 2.3.9 and earlier have an SQL injection vulnerability in blogController.php. This allows remote attackers to execute arbitrary SQL commands via the 'author' parameter.
SQL injection vulnerability in cron/find_help.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the version parameter.
The camel-snakeyaml component in Apache Camel is vulnerable to a Java object de-serialization vulnerability. De-serializing untrusted data can lead to serious security flaws.
The m_authenticate function in nefarious2 allows remote attackers to spoof certificate fingerprints, enabling them to log in as another user via a crafted AUTHENTICATE parameter.
A buffer overflow vulnerability in SMTP connection verification was discovered in SysGauge 1.5.18, leading to arbitrary code execution. An attacker can exploit this by using a crafted SMTP daemon that sends a long 220 (aka 'Service ready') string.
The dropbearconvert command in Dropbear SSH before version 2016.74 allows attackers to execute arbitrary code via a crafted OpenSSH key file.
CVE-2016-7406 in Dropbear SSH before version 2016.74 has a format string vulnerability that allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.
Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery scripts.
CVE-2016-10204 is an SQL injection vulnerability in Zoneminder 1.30 and earlier that allows remote attackers to execute arbitrary SQL commands via the limit parameter in a log query request to index.php.
The festivaltts4r gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the (1) to_speech or (2) to_mp3 method in lib/festivaltts4r/festival4r.rb.