CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The JMX servlet in Red Hat JBoss Enterprise Application Platform (EAP) 4 and 5 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object.
The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak permissions for the files /etc/sysconfig/tomcat and /etc/tomcat/tomcat.conf. This allows local users to gain privileges by leveraging membership in the tomcat group.
The Tomcat package on Red Hat Enterprise Linux 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, allowing local users to gain root privileges by leveraging membership in the tomcat group.
SAP Console version 7.30 allows local users to discover SAP Server login credentials by reading the Windows registry.
SAP Netweaver 7.4 allows remote authenticated users to bypass an intended Unified Connectivity (UCON) access control list and execute arbitrary Remote Function Modules (RFM) by leveraging a connection created from earlier execution of an anonymous RFM included in a Communication Assembly.
Siemens Automation License Manager (ALM) before 5.3 SP3 Update 1 is vulnerable to remote attacks that can lead to ALM service outage by sending crafted packets to TCP port 4410.
The Ruckus Wireless H500 web management interface is vulnerable to authenticated command injection. An attacker can exploit this vulnerability to execute arbitrary system commands.
The updater subsystem in Intel SSD Toolbox before version 3.3.7 allows local users to gain privileges via unspecified vectors.
The Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X and Android One devices has a vulnerability that allows attackers to obtain sensitive information via a crafted application making an iw_set_priv ioctl call.
An off-by-one error in the Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X and Android One devices allows attackers to gain privileges or cause a denial of service (buffer overflow) via a crafted application that makes a GET_CFG ioctl call.
An off-by-one error in the Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X and Android One devices allows attackers to gain privileges or cause a denial of service (buffer overflow) via a crafted application that makes a linkspeed ioctl call.
The system_server in Android before 2016-10-05 on Nexus devices has a vulnerability that allows attackers to gain privileges via a crafted application.
The NVIDIA camera driver in Android before 2016-10-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application.
The Synaptics touchscreen driver in Android before 2016-10-05 on Nexus 5X devices allows attackers to gain privileges via a crafted application.
The Synaptics touchscreen driver in Android before 2016-10-05 on Nexus 6P and Android One devices allows attackers to gain privileges via a crafted application.
The Qualcomm video driver in Android before 2016-10-05 on Nexus 5X, Nexus 6, Nexus 6P, and Android One devices has a vulnerability that allows attackers to gain privileges via a crafted application.
The Qualcomm video driver in Android before 2016-10-05 on Nexus 5X, Nexus 6, Nexus 6P, and Android One devices has a vulnerability that allows attackers to gain privileges via a crafted application.
The MediaTek video driver in Android before 2016-10-05 allows attackers to gain privileges via a crafted application.
The MediaTek video driver in Android before 2016-10-05 allows attackers to gain privileges via a crafted application.
Multiple integer overflows in the Qualcomm cryptographic engine driver in Android before 2016-10-05 allow attackers to gain privileges via a crafted application.