CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A stack-based buffer overflow in the ax Shared Libraries in the Agent in IBM Tivoli Monitoring (ITM) allows local users to gain privileges. This affects versions 6.2.2 before FP9, 6.2.3 before FP5, and 6.3.0 before FP2 on Linux and UNIX.
The notifications component in IBM TRIRIGA Applications 10.4 and 10.5 before 10.5.1 allows remote authenticated users to obtain sensitive password information, potentially leading to privilege escalation.
IBM IMS Enterprise Suite Data Provider before version 3.2.0.1 for Microsoft .NET allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.
CVE-2016-2884 is a CSRF vulnerability in IBM Forms Experience Builder versions 8.5.x and 8.6.x before 8.6.3.1, in an unspecified non-default configuration, allowing remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Multiple cross-site request forgery (CSRF) vulnerabilities in IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 allow remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
IBM QRadar SIEM versions 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 executes unspecified processes at an incorrect privilege level, making it easier for remote authenticated users to obtain root access by leveraging a command-injection issue.
SQL injection vulnerability in IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
IBM QRadar SIEM versions 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 use cleartext storage for unspecified passwords, allowing local users to obtain sensitive information by reading a configuration file.
Buffer overflow in send_redirect() in Boa Webserver 0.92r allows remote attackers to perform a DoS attack via an HTTP GET request with a long URI consisting only of '/' and '.' characters.
CVE-2016-2963 is a CSRF vulnerability in IBM BigFix Remote Control before version 9.1.3 that allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
IBM BigFix Remote Control before 9.1.3 allows local users to discover hardcoded credentials via unspecified vectors.
IBM BigFix Remote Control before version 9.1.3 uses cleartext storage for passwords, allowing local users to obtain sensitive information.
During an internal security review, Lenovo identified a local privilege escalation vulnerability in Lenovo System Interface Foundation software installed on some Windows 10 PCs where a user with local privileges could run arbitrary code with administrator level privileges.
There is a use-after-free vulnerability in DBD::mysql (DBD-mysql or the Database Interface (DBI) MySQL driver for Perl) versions 3.x and 4.x before 4.041 when used with mysql_server_prepare=1.
The nginx package before 1.6.2-5+deb8u3 on Debian jessie and earlier versions on Ubuntu and Gentoo allow local users with access to the web server user account to gain root privileges via a symlink attack on the error log.
Dell iDRAC7 and iDRAC8 devices with firmware before version 2.40.40.40 allow authenticated users to gain Bash shell access through a string injection.
In Apache Hadoop versions 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with the same privileges as the HDFS service.
The __get_user_asm_ex macro in the Linux kernel versions 4.4.22 through 4.4.28 contains extended asm statements that are incompatible with the exception table. This allows local users to gain root access on non-SMEP platforms via a crafted application.
In the Linux kernel before version 4.8.7, there is an issue with mishandling unsuccessful crypto registration in conjunction with successful key-type registration. This can lead to denial of service (NULL pointer dereference and panic) or possibly other unspecified impacts via a crafted application using the big_key data type.
In the Linux kernel up to version 4.8.11, there is a flaw in the kzalloc function in vfio_pci_intrs.c that can lead to integer overflow, resulting in denial of service or unspecified other impacts. Local users can exploit access to a vfio PCI device file.