CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.05)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
phpMyAdmin versions 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 do not properly choose delimiters, which may allow remote attackers to execute arbitrary PHP code via a crafted string.
In phpMyAdmin versions 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3, there is an SQL injection vulnerability in libraries/central_columns.lib.php. Remote attackers can execute arbitrary SQL commands via a crafted database name that is mishandled in a central column query.
A stack-based buffer overflow in the PlayMacro function in ObjectXMacro.ObjectXMacro in WdMacCtl.ocx in Micro Focus Rumba 9.x before 9.3 HF 11997 and 9.4.x before 9.4 HF 12815 allows remote attackers to execute arbitrary code via a long MacroName argument.
Multiple stack-based buffer overflows in COM objects in Micro Focus Rumba 9.4.x before 9.4 HF 13960 allow remote attackers to execute arbitrary code. The attack can be carried out through various properties and arguments in specific DLLs.
Apple AirPort Base Station firmware before 7.6.7 and 7.7.x before 7.7.7 misparses DNS data, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Cisco Prime Collaboration Provisioning 10.6 SP2 mishandles LDAP authentication, allowing remote attackers to obtain administrator privileges via a crafted login attempt.
The API in Cisco Prime Infrastructure versions 1.2 through 3.0 and Evolved Programmable Network Manager (EPNM) 1.2 allows remote attackers to execute arbitrary code or obtain sensitive management information via a crafted HTTP request.
The IBM Watson Developer Cloud services on Bluemix platforms do not properly generate random numbers for service-instance credentials, making it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.
Integer overflow in the TNEF unpacker in the AntiVirus Decomposer engine in Symantec products that may lead to unauthorized access or execution of malicious code.
It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. This allowed an attacker to bypass security restrictions and send and receive messages within the cluster.
SQL injection vulnerability in IBM Marketing Platform 8.5.x, 8.6.x, and 9.x before 9.1.2.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
The handle_regservice_request function in mDNSResponder before version 625.41.2 allows remote attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference) via unspecified vectors.
Multiple buffer overflows in mDNSResponder before version 625.41.2 allow remote attackers to read or write to out-of-bounds memory locations. The issues involve the GetValueForIPv4Addr, GetValueForMACAddr, rfc3110_import, and CopyNSEC3ResourceRecord functions.
A stack-based buffer overflow in Unitronics VisiLogic OPLC IDE before version 9.8.30 allows remote attackers to execute arbitrary code via a crafted filename field in a ZIP archive in a vlp file.
Fonality (previously trixbox Pro) versions 12.6 through 14.1i before 2016-06-01 has a hardcoded password for the FTP account, allowing remote attackers to gain access via FTP or SSH connection.
OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact.
EMC Data Domain OS versions 5.4 through 5.7 before 5.7.2.0 allows remote authenticated users to bypass intended password-change restrictions. This can be achieved by leveraging access to a different account with the same role as a target account or an account's session at an unattended workstation.
The printfDx function in Takumi Yamada DX Library for Borland C++ versions 3.13f through 3.16b, Gnu C++ versions 3.13f through 3.16b, and Visual C++ versions 3.13f through 3.16b allows remote attackers to execute arbitrary code via a crafted string.
The web-based management interface on Cisco RV110W, RV130W, and RV215W devices with outdated firmware allows remote attackers to execute arbitrary code as root via a crafted HTTP request.
The RMI service in SolarWinds Virtualization Manager 6.3.1 and earlier allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.