CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
IBM Kenexa LMS on Cloud versions 13.1 and 13.2 - 13.2.4 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server.
The IBM Security Guardium Database Activity Monitor appliance could allow a local user to inject commands that would be executed as root.
IBM InfoSphere Information Server is vulnerable to a denial of service caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume all available memory resources.
IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site request forgery, which could allow an attacker to execute malicious and unauthorized actions transmitted from a trusted user.
Tivoli Storage Manager Operations Center could allow a local user to take over a previously logged in user due to session expiration not being enforced.
IBM AppScan Enterprise Edition could allow a remote attacker to execute arbitrary code on the system, caused by improper handling of objects in memory. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system in the same context as the victim.
The IBM Tivoli Storage Manager (IBM Spectrum Protect) AIX client is vulnerable to a buffer overflow when Journal-Based Backup is enabled. A local attacker could overflow a buffer and execute arbitrary code on the system or cause a system crash.
IBM Security Privileged Identity Manager could allow a remote attacker to obtain sensitive information due to the failure to set the secure flag for the session cookie in SSL mode. An attacker could intercept its transmission within an HTTP session to capture the cookie and obtain sensitive information.
IBM Kenexa LCMS Premier on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.
IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
IBM AIX contains an unspecified vulnerability that allows a locally authenticated user to obtain root level privileges.
IBM Security Access Manager for Web is vulnerable to cross-site request forgery, which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information due to security misconfigurations.
IBM Tivoli Endpoint Manager could allow a user under special circumstances to inject commands that would be executed with unnecessary higher privileges than expected.
A vulnerability in the received packet parser of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) software could allow an unauthenticated, remote attacker to cause a reload of the affected system, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient size validation of user-supplied data.
A vulnerability in the data plane IP fragment handler of the Cisco ASA CX Context-Aware Security module could allow an unauthenticated, remote attacker to cause the CX module to be unable to process further traffic, resulting in a denial of service (DoS) condition. The issue is due to improper handling of IP fragments.
SAPlpd version 7400.3.11.33 in SAP GUI 7.40 on Windows has a Denial of Service vulnerability that causes service crashes with a long string sent to TCP port 515.
Array index error in the msm_sensor_config function in the camera driver on Samsung devices with Android KK (4.4) or L using APQ8084, MSM8974, or MSM8974pro chipsets may allow local users to have unspecified impact.
Directory traversal vulnerability in minitar before 0.6 and archive-tar-minitar 0.5.2 for Ruby allows remote attackers to write to arbitrary files via a .. (dot dot) in a TAR archive entry.
A vulnerability was discovered in Cisco WebEx browser extensions before version 1.0.7 on Google Chrome and before version 106 on Mozilla Firefox. An attacker could remotely execute arbitrary code with the privileges of the affected browser on the user's system.