CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools, affecting versions prior to 5.7. It allows an unauthenticated attacker with network access to compromise ASR.
A vulnerability in lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.
lshell version 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.
Buffer overflow in QuickTime before 7.7.1 for Windows allows remote attackers to execute arbitrary code.
FreeType 2 before March 24, 2017, has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1decode.c.
Yeager CMS version 1.2.1 has an SQL injection vulnerability in the password recovery feature that allows remote attackers to change the account credentials of known users via the 'userEmail' parameter.
D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 discloses usernames, passwords, keys, values, and web account hashes (super and admin) in plaintext when running a configuration backup.
D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of 'root' for the root account and 'tw' for the tw account, making it easier for remote attackers to gain administrative access.
A vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unauthenticated, unprivileged, network-based attacker to cause various denials of services leading to targeted information disclosure, modification of any component of the NorthStar system, including managed systems, and full denial of services to any systems under management which NorthStar interacts with using read-only or read-write credentials.
The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before version 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field. This allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string.
On the TP-Link TL-SG108E 1.0, admin network communications are encoded using the deprecated RC4 algorithm. This issue affects the 1.1.2 Build 20141017 Rel.50749 firmware.
On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from 'Switch Info' log lines where passwords are in cleartext. This affects the 1.1.2 Build 20141017 Rel.50749 firmware.
On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from 'SEND data' log lines where passwords are encoded in hexadecimal. This affects the 1.1.2 Build 20141017 Rel.50749 firmware.
Exponent CMS versions 2.4.1 and earlier have an SQL injection vulnerability via a base64 serialized API key (apikey parameter) in the api function of framework/modules/eaas/controllers/eaasController.php.
The backend/Login/load/ script in Shopware before version 5.1.5 allows remote attackers to execute arbitrary code.
Cygwin before 2.5.0 does not properly handle updating permissions when changing users, which allows attackers to gain privileges.
Versions of Spring AMQP before 1.5.5 contain a vulnerability in the org.springframework.core.serializer.DefaultDeserializer class that allows remote attackers to execute arbitrary code.
ExaGrid appliances with firmware before version 4.8 P26 have a default password (1) inflection for the root account and (2) support for the support account in the web interface, allowing remote attackers to gain administrative access via an SSH or HTTP session.
Tenable Appliance versions 3.5 - 4.4.0, and possibly prior versions, contain a flaw in the simpleupload.py script in the Web UI. A remote attacker can inject arbitrary commands through manipulation of the tns_appliance_session_user parameter.
Buffer overflow in D-Link devices DAP-2310, DAP-2330, DAP-2360, DAP-2553, DAP-2660, DAP-2690, DAP-2695, DAP-3320, and DAP-3662 allows remote attackers to have unspecified impact via a crafted 'dlink_uid' cookie.