CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Facebook HHVM versions before 3.15.0 contain an out-of-bounds write vulnerability in the mb_detect_encoding, mb_send_mail, and mb_detect_order functions. Attackers can exploit this vulnerability, leading to unspecified impact.
An issue was discovered in dotCMS through 3.6.1 related to the findChildrenByFilter() function, which performs string interpolation and direct SQL query execution. Although SQL quote escaping and a keyword blacklist were implemented, they can be bypassed for the q and inode parameters, leading to potential SQL injection attacks.
The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and simplesamlphp/saml2 library before 1.9.1, 1.10.x before 1.10.3, and 2.x before 2.3.3 allows remote attackers to spoof SAML responses or possibly cause a denial of service (memory consumption) by leveraging improper conversion of return values to boolean.
The (1) order and (2) group methods in Zend_Db_Select in Zend Framework before version 1.12.19 may allow remote attackers to conduct SQL injection attacks via vectors related to the use of the character pattern [\w]* in a regular expression.
The (1) order and (2) group methods in Zend_Db_Select in Zend Framework before version 1.12.20 may allow remote attackers to conduct SQL injection attacks due to failure to remove comments from an SQL statement before validation.
Zabbix before 2.2.14 and 3.0 before 3.0.4 has an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.
IBM Integration Bus versions 9.0 and 10.0 and WebSphere Message Broker SOAP FLOWS are vulnerable to a denial of service due to an XML External Entity Injection (XXE) error when processing XML data.
Multiple SQL injection vulnerabilities in modified eCommerce Shopsoftware 2.0.0.0 revision 9678, when the easybill-module is not installed, allow remote attackers to execute arbitrary SQL commands via the orders_status or customers_status parameter to api/easybill/easybillcsv.php.
IBM Websphere MQ JMS client versions 7.0.1, 7.1, 7.5, 8.0, and 9.0 allow deserialization of objects from untrusted sources, which could enable a malicious user to execute arbitrary Java code by adding vulnerable classes to the classpath.
Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (pycrypto) allows remote attackers to execute arbitrary code, as demonstrated by a crafted iv parameter to cryptmsg.py.
Adobe Digital Editions versions 4.5.3 and earlier have an exploitable heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.
Adobe Campaign versions 16.4 Build 8724 and earlier have a code injection vulnerability.
An issue was discovered in Smiths-Medical CADD-Solis Medication Safety Software (versions 1.0, 2.0, 3.0, and 3.1) that allows an authenticated user to gain elevated privileges on the SQL database. This enables modification of drug libraries, addition and deletion of users, and changes to user permissions.
An INFORMATION EXPOSURE flaw was discovered in the BINOM3 Universal Multifunctional Electric Power Quality Meter. This vulnerability can be exploited to gain privileged access to the device.
An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter related to lack of authentication for remote service, allowing access to application setup and configuration.
An issue was discovered on Phoenix Contact mGuard devices updated to Version 8.4.0, where updating the device resets the admin user's password to its default value.
A SQL injection vulnerability was discovered in Advantech WebAccess Version 8.1. To exploit this vulnerability, an attacker must supply malformed input to the WebAccess software.
An issue was discovered in Advantech WebAccess Version 8.1 that allows authentication bypass. A malicious user can access pages unrestricted by accessing a specific URL on the web server.
An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Version A17. Successful exploitation of this CROSS-SITE REQUEST FORGERY (CSRF) vulnerability can allow execution of unauthorized actions on the device such as configuration parameter changes, and saving modified configuration.
An access control flaw was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05 and VMU-C PV prior to firmware Version A17, allowing access to most application functions without authentication.