CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
AVer Information EH6108H+ devices with firmware X9.03.24.00.07l store passwords in a cleartext base64 format and require cleartext credentials in HTTP Cookie headers, allowing context-dependent attacks to obtain sensitive information.
Implementacja IKEv1 w systemie Cisco IOS w wersjach od 12.2 do 12.4 oraz od 15.0 do 15.6, IOS XE do 3.18S, IOS XR 4.3.x i 5.0.x do 5.2.x oraz PIX przed 7.0 pozwala zdalnym atakującym na uzyskanie wrażliwych informacji z pamięci urządzenia poprzez żądanie negocjacji Security Association (SA).
Buffer overflow in Rockwell Automation RSLogix Micro Starter Lite, RSLogix Micro Developer, RSLogix 500 Starter Edition, RSLogix 500 Standard Edition, and RSLogix 500 Professional Edition allows remote attackers to execute arbitrary code via a crafted RSS project file.
Yokogawa STARDOM FCN/FCJ controller versions R1.01 through R4.01 do not require authentication for Logic Designer connections, allowing remote attackers to reconfigure the device or cause a denial of service.
ABB DataManagerPro 1.x before 1.7.1 allows local users to gain privileges by replacing a DLL file in the package directory.
Cisco WebEx Meetings Server version 2.6 allows remote attackers to cause a denial of service (CPU consumption) by repeatedly accessing the account-validation component of an unspecified service.
UCS Manager and UCS 6200 Fabric Interconnects in Cisco Unified Computing System (UCS) through 3.0(2d) allow local users to obtain OS root access via crafted CLI input.
otool in Apple Xcode before version 8 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors.
otool in Apple Xcode before version 8 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors.
Cross-site scripting (XSS) vulnerability in EMC ViPR SRM before version 3.7.2 allows remote authenticated users to inject arbitrary web scripts or HTML via unspecified vectors.
Cloud Foundry PHP Buildpack before version 4.3.18 and PHP Buildpack Cf-release before version 242 place the .profile file in the htdocs directory, which might allow remote attackers to obtain sensitive information via an HTTP GET request for this file.
The metrics-collection component in RabbitMQ for Pivotal Cloud Foundry (PCF) 1.6.x before 1.6.4 logs command lines of failed commands, which might allow attackers to obtain sensitive information by reading the log data.
Multiple open redirect vulnerabilities in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.30 and 1.7.x before 1.7.8 allow remote attackers to redirect users to arbitrary web sites.
The client in EMC RSA BSAFE Micro Edition Suite (MES) versions 4.0.x before 4.0.9 and 4.1.x before 4.1.5 places the weakest algorithms first in a signature-algorithm list, making it easier for remote attackers to defeat cryptographic protection mechanisms.
Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.34 and 1.7.x before 1.7.12 places the 169.254.0.0/16 address in the all_open Application Security Group, which might allow remote attackers to bypass intended network-connectivity restrictions.
The php_wddx_push_element function in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial of service (invalid pointer access and out-of-bounds read) via an incorrect boolean element in a wddxPacket XML document, leading to mishandling in a wddx_deserialize call.
In PHP before 5.6.26 and 7.x before 7.0.11, there is a vulnerability in ext/intl/msgformat/msgformat_format.c that does not properly restrict the locale length provided to the Locale class in the ICU library. This can lead to application crashes or other unspecified impacts.
In PHP before version 5.6.26 and 7.x before 7.0.11, there is a vulnerability that does not verify that a BIT field has the UNSIGNED_FLAG flag. This can lead to remote denial of service (heap-based buffer overflow) or possibly other unspecified impacts via crafted field metadata.
Cisco WebEx Meetings Server version 2.6 allows remote attackers to execute arbitrary commands by injecting these commands into an application script.
Cisco AsyncOS through version 9.5.0-444 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (link saturation) by making many HTTP requests for overlapping byte ranges simultaneously.