CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The JEXTN Video Gallery extension version 3.0.5 for Joomla! has a SQL Injection vulnerability via the id parameter in a view=category action.
The 'JEXTN Question And Answer' extension version 3.1.0 for Joomla! has an SQL Injection vulnerability via the an parameter in a view=tags action or the ques-srch parameter.
The JBuildozer extension version 1.4.1 for Joomla! has a SQL Injection vulnerability via the appid parameter in an entriessearch action.
CVE-2017-17849 describes a buffer overflow vulnerability in GetGo Download Manager version 5.3.0.2712 and earlier. This could allow remote HTTP servers to execute arbitrary code on NAS devices via a long response.
A Credentials Management issue was discovered in Moxa NPort W2150A and NPort W2250A versions prior to 1.11. The default password is empty, allowing unauthorized users to access the device without a password.
A buffer overflow vulnerability in the password function in QNAP QTS versions 4.2.6, 4.3.3.0378, 4.3.4.0387 (Beta 2) and earlier could allow remote attackers to execute arbitrary code on NAS devices.
CVE-2017-17032 describes a buffer overflow vulnerability in the password function in QNAP QTS, which could allow remote attackers to execute arbitrary code on NAS devices.
CVE-2017-17031 describes a buffer overflow vulnerability in the password function in QNAP QTS, which could allow remote attackers to execute arbitrary code on NAS devices.
A buffer overflow vulnerability in the login function in QNAP QTS affects versions 4.2.6, 4.3.3.0378, 4.3.4.0387 (Beta 2) and earlier. This could allow remote attackers to execute arbitrary code on NAS devices.
A buffer overflow vulnerability in the login function in QNAP QTS affects versions 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier. This could allow remote attackers to execute arbitrary code on NAS devices.
A buffer overflow vulnerability in external device function in QNAP QTS versions 4.2.6, 4.3.3.0378, 4.3.4.0387 (Beta 2) and earlier could allow remote attackers to execute arbitrary code on NAS devices.
A buffer overflow vulnerability in the FTP service in QNAP QTS could allow remote attackers to execute arbitrary code on NAS devices.
Versions of puppetlabs-mysql from 3.1.0 to 3.6.0 allow remote attackers to bypass authentication by creating a database account without a password when the 'mysql_user' user parameter contains a host with a netmask.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Linksys WVBR0. Authentication is not required to exploit this vulnerability.
WTF/wtf/FastBitVector.h in WebKit, distributed in Safari Technology Preview Release 46, allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact. The issue arises from an improper call to the resizeSlow function, which mishandles cases where the old array length is greater than the new array length.
There is an SQL injection vulnerability in the LoginServlet page in SolarWinds Storage Manager, Storage Profiler, and Backup Profiler before version 5.1.2. This allows remote attackers to execute arbitrary SQL commands via the loginName field.
CVE-2017-6094 vulnerability allows forging 'chk' values for MAC addresses, enabling access to configuration settings of other subscribers. These settings may contain sensitive information such as credentials for VoIP services.
A Stack-based Buffer Overflow issue was discovered in Xiongmai Technology IP Cameras and DVRs using the NetSurveillance Web interface. This vulnerability may allow an attacker to execute code remotely or crash the device.
In BlogoText versions up to 3.7.6, a vulnerability allows attackers to bypass intended access restrictions via the email address field in the validate_form_preferences function in admin/preferences.php.
The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks. An example is a Resolv::Hosts::new argument beginning with a '|' character.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS