CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An issue was discovered in phpMyAdmin that allows bypassing the AllowRoot restriction and deny rules for username by using Null Byte in the username. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
An issue was discovered in phpMyAdmin involving the $cfg['ArbitraryServerRegexp'] configuration directive. An attacker could reuse certain cookie values in a way of bypassing the servers defined by ArbitraryServerRegexp.
An issue was discovered in phpMyAdmin related to the PHP unserialize() function, which does not verify the validity of data before deserialization. This can lead to code execution due to the interaction with object instantiation and autoloading.
Vulnerability in PwC ACE-ABAP 8.10.304 for SAP Security allows remote authenticated users to conduct ABAP injection attacks and execute arbitrary code via SAPGUI or Internet Communication Framework (ICF) over HTTP or HTTPS.
JFrog Artifactory before version 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, known as LDAP entry poisoning.
The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object.
Django versions 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user, making it easier for remote attackers to gain access to the database server.
The trove service user in Openstack deployment and Trove Barclamp in the Crowbar Framework has a default password, making it easier for remote attackers to gain access via unspecified vectors.
The file scanning mechanism JFilterInput::isFileSafe() in Joomla! CMS before version 3.6.5 does not consider alternative PHP file extensions when checking uploaded files for PHP content, allowing users to upload and execute files with .php6, .php7, .phtml, and .phpt extensions. Additionally, JHelperMedia::canUpload() did not blacklist these file extensions as uploadable file types.
Directory traversal vulnerability in 'jcss.php' in Zikula 1.3.x before 1.3.11 and 1.4.x before 1.4.4 on Windows allows a remote attacker to launch a PHP object injection by uploading a serialized file.
A vulnerability in Siemens SICAM PAS (all versions before V8.09) could allow a remote attacker to cause a Denial of Service condition and potentially lead to unauthenticated remote code execution by sending specially crafted packets to port 19234/TCP.
OmniVista 8770 versions 2.0 to 3.0 exposes different ORB interfaces that can be queried using the GIOP protocol on TCP port 30024. An attacker can bypass authentication and invoke methods that allow running arbitrary commands on the server with NT AUTHORITY\SYSTEM privileges.
IBM BigFix Remote Control before 9.1.3 does not properly restrict failed login attempts, making it easier for remote attackers to gain access via a brute-force approach.
In Exponent CMS version 2.4.0, there is a SQL injection vulnerability in the showComments method in expCommentController.php. The content_id parameter is used directly in the SQL query, allowing an attacker to manipulate data.
libdwarf version from October 21, 2016 allows context-dependent attackers to obtain sensitive information or cause a denial of service by using the 'malformed dwarf file' approach, related to a 'Heap Buffer Over-read' issue affecting the dwarf_util.c component.
The sctp_sf_ootb function in the Linux kernel before version 4.8.8 lacks chunk-length checking for the first chunk, allowing remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data.
CVE-2016-6725 describes a remote code execution vulnerability in the Qualcomm crypto driver in Android before November 5, 2016. An attacker could execute arbitrary code within the context of the kernel.
General Electric (GE) Bently Nevada 3500/22M USB devices with firmware before version 5.0 and Bently Nevada 3500/22M Serial have open ports, which makes it easier for remote attackers to obtain privileged access via unspecified vectors.
IBM Security Access Manager for Web versions 7.0 before IF2, 8.0 before 8.0.1.4 IF3, and Security Access Manager 9.0 before 9.0.1.0 IF5 allow remote authenticated users to execute arbitrary commands by leveraging LMI admin access.
In libtiff version 4.0.6, there is an out-of-bounds write in the tiffcp tool that affects tiled images with odd tile width versus image width. This issue was reported as MSVR 35103, also known as 'cpStripToTile heap-buffer-overflow.'