CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
HPE Release Control (RC) versions 9.13, 9.20, and 9.21 before 9.21.0005 p4 allow remote authenticated users to conduct server-side request forgery (SSRF) attacks, potentially leading to the disclosure of sensitive information or denial of service.
Cisco IOS versions 15.5(3)S3, 15.6(1)S2, 15.6(2)S1, and 15.6(2)T1 improperly dequeue invalid NTP packets, allowing remote attackers to cause a denial of service (interface wedge) by sending many crafted NTP packets.
The administrative web interface in Cisco TelePresence Video Communication Server Expressway X8.5.2 allows remote authenticated users to execute arbitrary commands via crafted fields.
A vulnerability in Cisco Unified Communications Manager IM and Presence Service allows remote attackers to cause a denial of service via crafted headers in a SIP packet, leading to a restart of the sipd process.
Cisco RV180 and RV180W devices allow remote authenticated users to execute arbitrary commands as root via a crafted HTTP request.
CVE-2016-1429 describes a vulnerability in the web interface of Cisco RV180 and RV180W devices that allows remote attackers to read arbitrary files via a crafted HTTP request.
Cisco RV110W, RV130W, and RV215W devices have an incorrect RBAC configuration for the default account, allowing remote authenticated users to obtain root access via a login session with that account.
The CLI command parser on Cisco RV110W, RV130W, and RV215W devices allows local users to execute arbitrary shell commands as an administrator via crafted parameters.
The auth_password function in sshd in OpenSSH before version 7.3 does not limit password lengths for authentication, allowing remote attackers to cause a denial of service via long strings.
The is_ashmem_file function in the KGSL Linux Graphics Module in Linux kernel 3.x mishandles pointer validation, allowing attackers to bypass intended access restrictions.
The MSM QDSP6 audio driver for Linux kernel 3.x has a vulnerability that allows attackers to cause a denial of service through out-of-bounds writes. This can lead to memory corruption or other unspecified impacts.
The MSM QDSP6 audio driver for Linux kernel 3.x has a vulnerability that allows attackers to cause a denial of service (buffer over-read) or potentially unspecified other impact via a crafted application making an ioctl call specifying many commands.
A stack-based buffer overflow exists in the supply_lm_input_write function in the MSM Thermal driver for Linux kernel 3.x. Attackers can exploit this vulnerability by sending a large amount of data through the debugfs interface, potentially leading to denial of service or unspecified other impacts.
In Android 5.x, a vulnerability allows attackers to bypass the DEVICE_POWER permission requirement via a broadcast intent with the PNW.stopSaver action.
Use-after-free vulnerability in the msm_set_crop function in the MSM-Camera driver for Linux kernel 3.x allows attackers to gain privileges or cause a denial of service via a crafted ioctl call.
Blink in Google Chrome before version 52.0.2743.116 does not ensure that a taint property is preserved after a structure-clone operation on an ImageBitmap object derived from a cross-origin image. This allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code.
Blink, as used in Google Chrome before version 52.0.2743.116, allows remote attackers to spoof the URL in the address bar via vectors involving a provisional URL for an initially empty document.
Multiple integer overflows in OpenJPEG, used in PDFium in Google Chrome before version 52.0.2743.116, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data.
Multiple integer overflows in io/prprf.c in Mozilla Netscape Portable Runtime (NSPR) before version 4.12 allow remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long string to a PR_*printf function.
CVE-2016-6635 is a CSRF vulnerability in the wp_ajax_wp_compression_test function in WordPress before version 4.5, allowing remote attackers to hijack administrators' authentication for changing the script compression option.