CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.05)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The IBM BigFix Platform could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free race condition. An attacker could exploit this vulnerability to execute arbitrary code on the system.
IBM Security Privileged Identity Manager Virtual Appliance version 2.0.2 has inadequate account lockout settings that could allow a remote attacker to brute force account credentials.
IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML data by the XML parser.
A vulnerability in a proprietary device driver in the kernel of Cisco TelePresence Multipoint Control Unit (MCU) Software could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition. The vulnerability is due to improper size validation when reassembling fragmented IPv4 or IPv6 packets.
A vulnerability in the web-based GUI of Cisco Prime Home allows an unauthenticated, remote attacker to bypass authentication and execute actions with administrator privileges. The issue is due to a processing error in the role-based access control (RBAC) of URLs.
The presence of a hardcoded account named 'core' in Fortinet FortiWLC allows attackers to gain unauthorized read/write access via a remote shell.
Multiple integer overflows in libXpm before version 3.5.12 can lead to remote denial of service or arbitrary code execution. The issue occurs when a program requests parsing XPM extensions on a 64-bit platform, potentially causing a heap-based buffer overflow.
MyBB before version 1.8.8 and MyBB Merge System before version 1.8.8 have a vulnerability that allows remote attackers to achieve unspecified impact via vectors related to 'loose comparison false positives'.
MyBB (MyBulletinBoard) before version 1.8.8 and MyBB Merge System before version 1.8.8 has an SQL injection vulnerability in the users data handler. This allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
MyBB before version 1.8.7 and MyBB Merge System before version 1.8.7 have a vulnerability that allows attackers to achieve unspecified impact via vectors related to low adminsid and sid entropy.
The newreply.php file in MyBB (MyBulletinBoard) before version 1.8.7 and MyBB Merge System before version 1.8.7 has a vulnerability that allows remote attackers to exploit a missing permission check.
There is an SQL injection vulnerability in the moderation tool in MyBB before version 1.8.7 and in the MyBB Merge System before version 1.8.7 that may allow remote attackers to execute arbitrary SQL commands.
SQL injection vulnerability in the Group Promotions module in the admin control panel in MyBB before 1.6.18 and 1.8.x before 1.8.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
An issue was discovered in Radisys MRF Web Panel (SWMS) version 9.0.1, where the MSM_MACRO_NAME POST parameter in /swms/ms.cgi is vulnerable to OS command injection attacks. This allows attackers to inject arbitrary OS commands and retrieve their output in the application's responses.
In Botan versions 1.8.0 through 1.11.33, an integer overflow could occur when decoding BER data, leading to an incorrect length field being computed. Some API callers may use the returned (incorrect and attacker controlled) length field in a way that later causes memory corruption or other failures.
A NULL pointer dereference in the fimg2d driver for Android L (5.0/5.1) and M (6.0) on Samsung Exynos processors allows for unspecified impact via unknown vectors.
Multiple directory traversal vulnerabilities in Trend Micro Smart Protection Server allow remote attackers to read and delete arbitrary files via the tmpfname parameter in several PHP scripts.
SQL injection vulnerability in class-wp-query.php in WP_Query in WordPress before version 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the presence of an affected plugin or theme that mishandles a crafted post type name.
An issue was discovered on the D-Link DWR-932B router. qmiweb allows command injection with ` characters.
An issue was discovered on the D-Link DWR-932B router that allows the command '/sbin/telnetd -l /bin/sh' to be executed by HELODBG on port 39889 (UDP).