CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unspecified vulnerability in the Oracle iStore component in Oracle E-Business Suite 12.1.1 through 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality and integrity via vectors related to Runtime Catalog.
Unspecified vulnerability in the Oracle Commerce Guided Search component in versions 6.2.2, 6.3.0, 6.4.1.2, and 6.5.0 through 6.5.2 allows remote attackers to affect confidentiality and integrity via unknown vectors.
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to JavaServer Faces.
Unspecified vulnerability in the BI Publisher component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remote authenticated users to affect confidentiality via unknown vectors.
The Ruckus Wireless H500 web management interface is vulnerable to a denial of service (DoS) attack, which may lead to service unavailability.
The Ruckus Wireless H500 web management interface is vulnerable to a CSRF (Cross-Site Request Forgery) attack, which could allow unauthorized actions to be performed by a malicious user.
TGCaptcha2 version 0.3.0 is vulnerable to a replay attack due to a missing nonce allowing attackers to use a single solved CAPTCHA multiple times.
IBM Security Guardium Database Activity Monitor versions 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allow local users to obtain administrator privileges for command execution via unspecified vectors.
IBM Rational Quality Manager (RQM) and Rational Collaborative Lifecycle Management versions before iFix8, 4.x before 4.0.7 iFix11, 5.x before 5.0.2 iFix17, and 6.x before 6.0.1 ifix3 allow remote authenticated users to execute arbitrary OS commands via a crafted 'HTML request.'
IBM Security Guardium versions 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allow local users to obtain sensitive cleartext information via unspecified vectors, as demonstrated by password information.
IBM Security Guardium Database Activity Monitor versions 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allow remote authenticated users to spoof administrator accounts by sending a modified login request over HTTP.
IBM Security Guardium Database Activity Monitor versions 9.x through 9.5 before p700 and 10.x through 10.0.1 before p100 allow remote authenticated users to make HTTP requests with administrator privileges via unspecified vectors.
IBM Security Guardium Database Activity Monitor versions 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allow remote authenticated users to execute arbitrary commands with root privileges via the search field.
The Huge IT catalog plugin version 1.0.4 for Joomla contains vulnerabilities to SQL Injection (SQLi) and Cross-Site Scripting (XSS) attacks. These flaws can be exploited by attackers to gain unauthorized access to data or execute malicious code.
XSS and SQL Injection vulnerabilities have been identified in HugeIT slideshow version 1.0.4, which can be exploited by attackers to inject malicious code and manipulate database data.
XSS and SQLi vulnerabilities have been identified in HugeIT slideshow version 1.0.4, which can be exploited by attackers to inject malicious code and manipulate the database.
Version 1.1.0 of the Huge-IT Portfolio Gallery manager has SQL Injection and XSS vulnerabilities that can be exploited by malicious users.
Version 1.1.0 of the Huge-IT Portfolio Gallery manager is vulnerable to SQL Injection and XSS attacks. These vulnerabilities may allow attackers to execute unauthorized database queries and inject malicious JavaScript code.
ISC BIND versions 9.1.0 through 9.8.4-P2 and 9.9.0 through 9.9.2-P2 allow remote attackers to cause a denial of service (assertion failure and daemon exit) via malformed options data in an OPT resource record.
The IP stack in the Linux kernel before 4.6 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for packets with tunnel stacking.