CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
MyBB (MyBulletinBoard) versions 1.8.x before 1.8.2 have an SQL injection vulnerability in member.php that allows remote attackers to execute arbitrary SQL commands via the question_id parameter in a do_register action.
SQL injection vulnerability in the IPS Connect service in Invision Power Board 3.3.x and 3.4.x through 3.4.7 before 20141114 allows remote attackers to execute arbitrary SQL commands via the id[] parameter.
SQL injection vulnerability in Proticaret E-Commerce 3.0 allows remote attackers to execute arbitrary SQL commands via a tem:Code element in a SOAP request.
CVE-2014-9157 is a vulnerability in the yyerror function in the Graphviz library that allows remote attackers to exploit format string specifiers in unknown vectors, leading to unspecified impact.
An unrestricted file upload vulnerability in the Huawei Honor Cube Wireless Router WS860s before V100R001C02B222 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
Canto Curses before version 0.9.0 contains a vulnerability that allows remote feed servers to execute arbitrary commands via shell metacharacters in a feed URL.
CVE-2014-9220 describes an SQL injection vulnerability in OpenVAS Manager before version 4.0.6 and 5.x before version 5.0.7. It allows remote attackers to execute arbitrary SQL commands via the timezone parameter in a modify_schedule OMP command.
The installer in Thomson Reuters Fixed Assets CS 13.1.4 and earlier uses weak permissions for connectbgdl.exe, allowing local users to execute arbitrary code by modifying this program.
ZTE ZXDSL 831CII has a default password of 'admin' for the admin account, which allows remote attackers to gain administrator privileges.
The Smarty Pants Plugins SP Project & Document Manager plugin version 2.4.1 and earlier contains multiple SQL injection vulnerabilities in the classes/ajax.php file. Attackers can remotely execute arbitrary SQL commands through specific parameters in the functions.
The wpDataTables plugin version 1.5.3 and earlier contains an SQL injection vulnerability in the wpdatatables.php file. This allows remote attackers to execute arbitrary SQL commands via the table_id parameter in a get_wdtable action to wp-admin/admin-ajax.php.
The Google Doc Embedder plugin for WordPress before version 2.5.15 has an SQL injection vulnerability in view.php that allows remote attackers to execute arbitrary SQL commands via the gpid parameter.
CCH Wolters Kluwer ProSystem fx Engagement version 7.1 and earlier uses weak permissions for service files, allowing local users to gain LocalSystem privileges via a Trojan horse file.
CVE-2014-8728 describes an SQL injection vulnerability in the login page of Subex ROC Fraud Management in version 7.4 and earlier. It allows remote attackers to execute arbitrary SQL commands via the ranger_user[name] parameter.
The host-deny.sh script in OSSEC before version 2.8.1 writes to temporary files with predictable filenames without verifying ownership. This allows local users to modify access restrictions in hosts.deny and gain root privileges by creating the temporary files before automatic IP blocking occurs.
The _user_resource_create function in the Services module 7.x-3.x before 7.x-3.10 for Drupal uses a password of '1' when creating new user accounts, making it easier for remote attackers to guess the password via a brute force attack.
The Services module 7.x-3.x before 7.x-3.10 for Drupal does not properly limit the rate of authentication attempts, making it easier for remote attackers to gain access via a brute-force attack on the administrative password.
An integer underflow in the ksba_oid_to_str function in Libksba before version 1.3.2 allows remote attackers to cause a denial of service (crash) via a crafted OID in an S/MIME message or ECC based OpenPGP data.
Multiple SQL injection vulnerabilities in MantisBT before version 1.2.18 in view_all_bug_page.php allow remote attackers to execute arbitrary SQL commands via the sort or dir parameter to view_all_set.php.
The management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to obtain credentials by reading the configuration files.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS