CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A directory traversal vulnerability in the Web Administration tool in IBM Tivoli Directory Server and IBM Security Directory Server allows remote attackers to read arbitrary files via a '..' (dot dot) in a URL.
Tollgrade LightHouse SMS before 5.1 patch 3 allows remote authenticated users to bypass an intended administrative-authentication requirement and read or change parameter values via a direct request.
Tollgrade LightHouse SMS before 5.1 patch 3 allows remote attackers to bypass authentication and restart the software via unspecified vectors.
An unspecified ActiveX control in Schneider Electric SoMachine HVAC Programming Software for M171/M172 Controllers before version 2.1.0 allows remote attackers to execute arbitrary code via unknown vectors, related to the INTERFACESAFE_FOR_UNTRUSTED_CALLER flag.
The CLI in Cisco IOS XR versions 6.x through 6.0.1 allows local users to execute arbitrary OS commands in a privileged context by leveraging unspecified container access.
Cisco WebEx Meetings Server version 2.6 allows remote authenticated users to conduct command-injection attacks via file type related to uploads, known as Bug ID CSCuy92715.
SQL injection vulnerability in Cisco WebEx Meetings Server 2.6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Cisco IOS XR versions 5.x through 5.2.5 on NCS 6000 devices allows remote attackers to cause a denial of service via crafted SSH traffic, leading to timer consumption and Route Processor reload.
Huawei HiSuite versions before 4.0.4.204_ove (Out of China) and before 4.0.4.301 (China) use a weak ACL (FILE_WRITE_DATA for BUILTIN\Users) for the HiSuite service directory. This allows local users to gain SYSTEM privileges via a Trojan horse, such as SspiCli.dll or USERENV.dll files.
Apache Qpid AMQP 0-x JMS client before version 6.0.4 and JMS (AMQP 1.0) before version 0.10.0 does not restrict the use of classes available on the classpath, which may allow remote authenticated users to deserialize arbitrary objects and execute arbitrary code.
CVE-2016-4066 is a CSRF vulnerability in Fortinet FortiWeb before version 5.5.3 that allows remote attackers to hijack the authentication of administrators for password change requests via unspecified vectors.
Kinit in KDE Frameworks before version 5.23.0 uses weak permissions (644) for the /tmp/xauth-xxx-_y file, allowing local users to obtain X11 cookies of other users.
A use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.17, and Acrobat and Acrobat Reader DC Classic before 15.006.30198, as well as Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X, allows attackers to execute arbitrary code via unspecified vectors.
A heap-based buffer overflow in Adobe Flash Player before version 18.0.0.366 and 19.x through 22.x before version 22.0.0.209 on Windows and OS X and before version 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors.
Use-after-free vulnerability in Adobe Flash Player before version 18.0.0.366 and 19.x through 22.x before version 22.0.0.209 on Windows and OS X and before version 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors.
Adobe Flash Player versions before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player versions before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player versions before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player versions before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player versions before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.