CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2017-13707 affects Replibit Backup Manager versions earlier than 2017.08.04, allowing privilege escalation to root level via sudo command execution. Attackers can access the vi program through sudo, enabling them to navigate the filesystem and modify critical files such as /etc/passwd.
In Kaspersky Internet Security for Android version 11.12.4.1622, some exported application activities have weak permissions, which may be exploited by malware to gain unauthorized access to the product's functionality using Android IPC.
A Stack-based Buffer Overflow issue was discovered in SpiderControl SCADA MicroBrowser Versions 1.6.30.144 and prior. Opening a maliciously crafted html file may cause a stack overflow.
A stack-based buffer overflow exists in the D-Link firmware DNR-320L, DNS-320LW, DNR-322L, DNR-326, and DNS-327L in the login_mgr.cgi file. Remote attackers can execute arbitrary code by crafting malformed 'Host' and 'Referer' header values.
The check_login function in D-Link DNR-326 before version 2.10 build 03 allows remote attackers to bypass authentication and log in by setting the username cookie parameter to an arbitrary string.
D-Link DNS-320L firmware before 1.04b12, DNS-327L before 1.03b04 Build0119, DNR-326 1.40b03, DNS-320B 1.02b01, DNS-345 1.03b06, DNS-325 1.05b03, and DNS-322L 2.00b07 allow remote attackers to bypass authentication and log in with administrator permissions by passing the cgi_set_wto command in the cmd parameter and setting the spawned session's cookie to username=admin.
Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the act parameter to ajax.php.
The samsung_extdisp driver in the Samsung S4 (GT-I9500) kernel 3.4 and earlier allows attackers to cause a denial of service (memory corruption) or gain privileges.
SQL Injection exists in NexusPHP version 1.5.beta5.20120707 via the setanswered parameter to staffbox.php.
SQL Injection exists in NexusPHP version 1.5.beta5.20120707 via the delcheater parameter to cheaterbox.php.
Progress Telerik UI dla ASP.NET AJAX przed R2 2017 SP2 nie ogranicza poprawnie wejścia użytkownika w RadAsyncUpload, co pozwala zdalnym atakującym na przesyłanie dowolnych plików lub wykonywanie dowolnego kodu.
Telerik.Web.UI w Progress Telerik UI dla ASP.NET AJAX przed R1 2017 oraz R2 przed R2 2017 SP2 wykorzystuje słabą metodę szyfrowania RadAsyncUpload, co umożliwia zdalnym atakującym przesyłanie dowolnych plików lub wykonywanie dowolnego kodu.
Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID parameter.
The mkostemp function in login-utils in util-linux, when used incorrectly, allows remote attackers to cause file name collision and possibly other attacks.
The FormCraft Basic plugin version 1.0.5 for WordPress has an SQL injection vulnerability in the id parameter in form.php.
A double free vulnerability in the _zip_dirent_read function in zip_dirent.c in libzip allows attackers to have unspecified impact via unknown vectors.
CVE-2017-12791 describes a vulnerability in minion ID validation in SaltStack Salt before version 2016.11.7 and 2017.7.x before 2017.7.1. This allows remote minions with incorrect credentials to authenticate to a master using a crafted minion ID.
In ImageMagick before version 6.9.9-0 and 7.x before version 7.0.6-1, there is a vulnerability in the ReadOneMNGImage function in coders/png.c that leads to an out-of-bounds read with the MNG CLIP chunk.
Apache Pony Mail versions 0.6c through 0.8b allow remote attackers to bypass authentication.
WAGO IO 750-849 version 01.01.27 and WAGO IO 750-881 version 01.02.05 do not contain privilege separation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS