CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.05)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Doorkeeper gem before version 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens due to failure to implement the OAuth 2.0 Token Revocation specification.
Directory traversal vulnerability in Liferay 5.1.0 allows remote attackers to have unspecified impact via a %2E%2E (encoded dot dot) in the minifierBundleDir parameter to barebone.jsp.
The TIFFReadRawStrip1 and TIFFReadRawTile1 functions in libtiff before version 4.0.7 allow remote attackers to cause a denial of service (crash) or possibly obtain sensitive information via a negative index in a file-content buffer.
Integer overflow in the mov_build_index function in libavformat/mov.c in FFmpeg before 2.8.8, 3.0.x before 3.0.3 and 3.1.x before 3.1.1 allows remote attackers to have unspecified impact via vectors involving sample size.
Buffer overflow in the HTTP URL parsing functions in pecl_http before 3.0.1 might allow remote attackers to execute arbitrary code via non-printable characters in a URL.
CVE-2016-5742 is an SQL injection vulnerability in the XML-RPC interface in Movable Type Pro and Advanced versions before 6.1.3 and 6.2.x before 6.2.6, as well as Movable Type Open Source version 5.2.13 and earlier. It allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data.
Multiple use-after-free and double-free vulnerabilities in gifcolor.c in GIFLIB 5.1.2 have unspecified impact and attack vectors.
Buffer overflow in the collector.exe listener of Landesk Management Suite 10.0.0.271 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large packet.
The Avaya Fabric Connect Virtual Services Platform (VSP) Operating System Software (VOSS) before version 4.2.3.0 and 5.x before version 5.0.1.0 does not properly handle VLAN and I-SIS indexes, allowing remote attackers to gain unauthorized access via crafted Ethernet frames.
Exponent CMS 2.x before 2.3.7 Patch 3 allows remote attackers to execute arbitrary code via the sc parameter to install/index.php.
An integer underflow in header.c in lha allows remote attackers to have unspecified impact via a large header size value for the (1) level0 or (2) level1 header in a lha archive, which triggers a buffer overflow.
A stack-based buffer overflow in the ValidateMove function in frontend/move.cc in GNU Chess (aka gnuchess) before version 6.2.4 may allow context-dependent attackers to execute arbitrary code via a large input, as demonstrated in UCI mode.
The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms.
Vivint Sky Control Panel version 1.1.1.9926 allows remote attackers to enable and disable the alarm system and modify other security settings via the Web-enabled interface.
An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13 related to a blind SQL injection in template.jsp. This vulnerability can be exploited without authentication via an HTTP POST request, allowing attackers to dump database data to a malicious server.
In GeniXCMS before version 1.0.0, there is an SQL injection vulnerability in inc/lib/Options.class.php that allows remote attackers to execute arbitrary SQL commands via the modules parameter.
CVE-2017-5574 is an SQL injection vulnerability in register.php in GeniXCMS before version 1.0.0 that allows unauthenticated users to execute arbitrary SQL commands via the activation parameter.
The patch for directory traversal (CVE-2017-5480) in b2evolution version 6.8.4-stable has a bypass vulnerability. An attacker can use ../ to bypass the filter rule, allowing them to delete or read any files on the server.
Akamai NetSession version 1.9.3.1 is vulnerable to DLL Hijacking as it attempts to load CSUNSAPI.dll without supplying the complete path. The issue is aggravated because the mentioned DLL is missing from the installation, allowing for DLL hijacking and code injection into the Akamai NetSession process space.