CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Huge-IT Video Gallery version 1.0.9 for Joomla is vulnerable to unauthenticated SQL injection, which can be exploited by an attacker to gain access to the database.
Version 1.1.5 of the huge IT gallery for Joomla has identified XSS and SQLi vulnerabilities. An attacker can exploit these flaws to execute malicious code or manipulate database data.
The contus-video-comments plugin version 1.0 for WordPress allows unauthenticated remote .jpg file uploads.
The WordPress plugin Dukapress version 2.5.9 contains a blind SQL injection vulnerability, which may allow attackers to execute unauthorized queries against the database.
The WordPress plugin google-adsense-and-hotel-booking version 1.05 contains an open proxy, which may lead to unauthorized access to system resources.
CVE-2015-1000003 affects the filedownload plugin version 1.4 for WordPress, which is vulnerable to Blind SQL Injection. An attacker can exploit this vulnerability to execute unauthorized database queries.
The fast-image-adder plugin version 1.1 for WordPress has a vulnerability that allows remote file uploads.
The vulnerability allows remote file uploads in the mailcwp plugin version 1.99 for WordPress.
Buffer overflow in the Overlay Transport Virtualization (OTV) GRE feature in Cisco NX-OS 5.0 through 7.3 on Nexus 7000 and 7700 devices allows remote attackers to execute arbitrary code via long parameters in a packet header.
The rsyncd server in Fortinet FortiWLC versions 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 has a hardcoded rsync account, allowing remote attackers to read or write to arbitrary files via unspecified vectors.
The SCTC_REFRESH_EXPORT_TAB_COMP, SCTC_REFRESH_CHECK_ENV, and SCTC_TMS_MAINTAIN_ALOG functions in the SCTC subpackage in SAP Netweaver 7.40 SP 12 allow remote authenticated users with certain permissions to execute arbitrary commands via a CALL 'SYSTEM' statement.
CVE-2016-7161 involves a heap-based buffer overflow in the .receive callback of xlnx.xps-ethernetlite in QEMU, allowing attackers to execute arbitrary code on the QEMU host via a large ethlite packet.
F5 BIG-IP LTM systems in versions 11.x before 11.2.1 HF16, 11.3.x, 11.4.x before 11.4.1 HF11, 11.5.0, 11.5.1 before HF11, 11.5.2, 11.5.3, 11.5.4 before HF2, 11.6.0 before HF8, 11.6.1 before HF1, 12.0.0 before HF4, and 12.1.0 before HF2 allow remote attackers to modify or extract system configuration files via vectors involving NAT64.
Johnson & Johnson Animas OneTouch Ping devices mishandle acknowledgements, which makes it easier for remote attackers to bypass authentication via a custom communication protocol.
Johnson & Johnson Animas OneTouch Ping devices allow remote attackers to bypass authentication via replay attacks.
Beckhoff Embedded PC images before October 22, 2014, and ADS TwinCAT components may allow remote attackers to gain access via the Windows CE Remote Configuration Tool, CE Remote Display service, or TELNET service.
Beckhoff Embedded PC images before October 22, 2014, and ADS TwinCAT components do not restrict the number of authentication attempts, making it easier for remote attackers to gain access via a brute-force attack.
The vApp Managers web application in EMC Unisphere for VMAX Virtual Appliance 8.x before 8.3.0 and Solutions Enabler Virtual Appliance 8.x before 8.3.0 allows remote attackers to execute arbitrary code via crafted input to the (1) GetSymmCmdRequest or (2) RemoteServiceHandler class.
The client in EMC Replication Manager (RM) before version 5.5.3.0_01-PatchHotfix, EMC Network Module for Microsoft 3.x, and EMC Networker Module for Microsoft 8.2.x before version 8.2.3.6 allows remote RM servers to execute arbitrary commands by placing a crafted script in an SMB share.
Buffer overflow in the PPPoE module in Huawei USG2100, USG2200, USG5100, and USG5500 unified security gateways with software before V300R001C10SPC600, when CHAP authentication is configured on the server, allows remote attackers to cause a denial of service (server restart) or execute arbitrary code via crafted packets sent during authentication.