CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.25)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class.
Sierra Wireless GX 440 devices with ALEOS firmware version 4.3.2 execute the management web application as root.
Sierra Wireless GX 440 devices with ALEOS firmware version 4.3.2 allow Hayes AT command injection.
OSRAM SYLVANIA Osram Lightify Pro through July 26, 2016 allows Zigbee replay.
Osram Lightify Pro through July 26, 2016, does not use SSL pinning, which may lead to man-in-the-middle attacks.
Osram Lightify Pro before July 26, 2016, uses only 8 hex digits for a PSK, which may weaken security.
Osram Lightify Home through July 26, 2016, allows Zigbee replay, which may lead to unauthorized access to the system.
Osram Lightify Home through July 26, 2016, does not use SSL pinning, which may lead to man-in-the-middle attacks.
Osram Lightify Home before July 26, 2016, stores a PSK in cleartext under /private/var/mobile/Containers/Data/Application.
Atlassian JIRA Server before version 7.1.9 has a CSRF vulnerability in auditing/settings.
OpenCV version 3.0.0 has a double free issue that allows attackers to execute arbitrary code.
AXIS Communications products with firmware through 5.80.x allow remote attackers to modify arbitrary files as root via vectors involving Open Script Editor, which is a resource injection vulnerability.
AXIS Communications products are vulnerable to CSRF attacks, as demonstrated by admin/pwdgrp.cgi, vaconfig.cgi, and admin/local_del.cgi.
Dell Integrated Remote Access Controller (iDRAC) 6 before version 2.80 allows remote attackers to execute arbitrary administrative HTTP commands.
Dell Integrated Remote Access Controller (iDRAC) 6 before version 2.80 and 7/8 before version 2.21.21.21 allows directory traversal.
Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, allowing remote attackers to conduct hijacking attacks and bypass ACL checks.
The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass ACL checks via a crafted host value.
Liebert MultiLink Automated Shutdown version 4.2.4 allows local users to gain privileges by replacing the LiebertM executable file.
Castle Rock Computing SNMPc before 2015-12-17 has SQL injection via the sc parameter.
The Summer Baby Zoom Wifi video monitoring system allows remote attackers to gain privileges via manual entry of a Settings URL.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS