CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
LibreOffice before December 22, 2016, has an out-of-bounds write caused by a heap-based buffer overflow related to the EnhWMFReader::ReadEnhWMF function in vcl/source/filter/wmf/enhwmf.cxx.
SQL injection vulnerability in SAP Business Intelligence platform before January 2017 allows remote attackers to obtain sensitive information, modify data, cause a denial of service (data deletion), or launch administrative operations or possibly OS commands via a crafted SQL query.
The datamover module in the Linux version of NovaBACKUP DataCenter before 09.06.03.0353 is vulnerable to remote command execution via unspecified attack vectors.
The datamover module in the Linux version of NovaBACKUP DataCenter before 09.06.03.0353 is vulnerable to remote command execution via unspecified attack vectors.
The HTTP header injection vulnerability in the URLConnection class in Android OS from version 2.2 to 6.0 allows remote attackers to execute arbitrary scripts or set arbitrary values in cookies.
KanColleViewer versions 3.8.1 and earlier operates as an open proxy, allowing remote attackers to trigger outbound network traffic.
The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the 'url' parameter.
Samsung SecEmailSync on SM-G920F build G920FXXU2COH2 (Galaxy S6) devices is vulnerable to SQL injection, also known as SVE-2015-5081.
In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the osip_clrncpy() function defined in osipparser2/osip_port.c.
Android versions from 4.0.3 to 5.x before 5.1 contain a vulnerability in the mediaserver component that allows attackers to gain privileges.
A vulnerability in mediaserver in Android versions 2.2 through 5.x before 5.1 allows attackers to gain privileges.
SAP HANA DB version 1.00.73.00.389160 allows remote attackers to execute arbitrary code via vulnerabilities involving the audit logs.
The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes.
SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands via the searchFriends function to friends.inc.php.
SeaWell Networks Spectrum SDC version 02.05.00 has a default password of 'admin' for the 'admin' account.
The AMF3CD_AddProp function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to execute arbitrary code.
A buffer underflow vulnerability exists in the Debian inspircd package before version 2.0.5-1+deb7u1 for wheezy and before version 2.0.16-1 for jessie and sid. This issue arises from an incomplete fix of CVE-2012-1836.
The 'Smart related articles' extension version 1.1 for Joomla! has an SQL injection vulnerability in dialog.php. An attacker must use the search_cats variable in the POST method to exploit this vulnerability.
An issue was discovered in api/includes/systems.php in Unitrends Enterprise Backup before version 9.0.0. User input is not properly filtered before being sent to a popen function, allowing for remote code execution.
An unprivileged user of the Unitrends Enterprise Backup before version 9.0.0 can escalate to root privileges by modifying the 'token' cookie issued at login.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS