CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The virtual network stack on Cisco AMP Threat Grid Appliance devices before 2.1.1 allows remote attackers to bypass a sandbox protection mechanism, consequently obtaining sensitive interprocess information or modifying interprocess data via a crafted malware sample.
The administrative web interface in Cisco Prime Infrastructure (PI) before 3.1.1 allows remote authenticated users to execute arbitrary commands via crafted field values.
Apache HTTP Server versions 2.4.18 to 2.4.20, when mod_http2 and mod_ssl are enabled, improperly recognize the 'SSLVerifyClient require' directive for HTTP/2 request authorization. This allows remote attackers to bypass intended access restrictions.
The web-restore interface in Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar through 7.1.2 and 7.2.x through 7.2.1 allows remote authenticated users to read or delete directories via a Linux backup-restore operation.
The vulnerability in ntpd in NTP before version 4.2.8p8 allows remote attackers to cause a daemon crash by sending a crypto-NAK packet. This issue exists due to an incorrect fix for CVE-2016-1547.
The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service by modifying the peer variable through spoofed packets from many source IP addresses in a certain scenario.
NTP in versions 4.x before 4.2.8p8 is vulnerable to an attack that can lead to denial of service. A remote attacker can send a spoofed crypto-NAK packet with incorrect authentication data, resulting in the demobilization of ephemeral associations.
Apache Struts 2 versions 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.
Apache Struts 2 versions 2.3.20 through 2.3.28.1 allow remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.
Apache Struts 2 versions 2.3.20 through 2.3.28.1 mishandle token validation, allowing remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.
The ActionServlet.java in Apache Struts 1 versions 1.1.x through 1.3.10 has improper restriction of the Validator configuration, allowing remote attackers to conduct cross-site scripting (XSS) attacks or cause denial of service via crafted input.
The ActionServlet.java in Apache Struts 1 versions 1.1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, allowing remote attackers to execute arbitrary code or cause a denial of service via unexpected memory access.
The MultiPageValidator implementation in Apache Struts 1 versions 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.
The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from kernel heap memory by leveraging in-container root access to provide a crafted offset value.
A vulnerability in the setsockopt implementation in the netfilter subsystem of the Linux kernel before version 4.6.3 allows local users to gain privileges or cause a denial of service by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement.
CVE-2016-2863 describes a CSRF vulnerability in IBM WebSphere Commerce that allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences. It affects version 7.0 Feature Pack 8, 8.0.0.x before 8.0.0.10, and 8.0.1.x before 8.0.1.2.
Multiple unspecified vulnerabilities in Google Chrome before version 51.0.2704.103 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Cisco EPC3928 devices allow remote attackers to obtain sensitive configuration and credential information by making requests during the early part of the boot process, related to a 'Boot Information Disclosure' issue.
CVE-2016-1336 affects Cisco EPC3928 devices, where remote attackers can cause a device crash by sending a long LanguageSelect parameter. This issue is related to a 'Gateway HTTP Corruption Denial of Service' problem.