CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2016-1328 affects Cisco EPC3928 devices, where remote attackers can cause a device crash by sending an overly long h_sortWireless parameter in a goform/WClientMACList request.
A stack-based buffer overflow in ELCSimulator in Eaton ELCSoft 2.4.01 and earlier allows remote attackers to execute arbitrary code via a long packet.
The NTP time-server interface on Meinberg IMS-LANTIME and LANTIME devices with firmware before version 6.20.004 allows remote authenticated users to obtain root privileges for writing to unspecified scripts. This can lead to obtaining sensitive information or modifying data.
Multiple stack-based buffer overflows in the NTP time-server interface on Meinberg IMS-LANTIME and LANTIME devices, as well as SyncFire 1100 and LCES with firmware before version 6.20.004, allow remote attackers to obtain sensitive information, modify data, or cause a denial of service via a crafted parameter in a POST request.
A stack-based buffer overflow exists in the NTP time-server interface on Meinberg devices that can be exploited by remote attackers. Firmware versions prior to 6.20.004 are vulnerable to attacks that may lead to sensitive information disclosure, data modification, or denial of service.
A cross-site request forgery (CSRF) vulnerability exists in NTT EAST Hikari Denwa and NTT WEST Hikari Denwa routers. This affects routers with firmware PR-400MI, RT-400MI, and RV-440MI versions 07.00.1006 and earlier for NTT EAST and 07.00.1005 and earlier for NTT WEST, allowing remote attackers to hijack the authentication of arbitrary users.
NTT EAST Hikari Denwa routers with firmware PR-400MI, RT-400MI, and RV-440MI version 07.00.1006 and earlier, and NTT WEST Hikari Denwa routers with firmware PR-400MI, RT-400MI, and RV-440MI version 07.00.1005 and earlier allow remote authenticated users to execute arbitrary OS commands via unspecified vectors.
The Transformation implementation in phpMyAdmin versions 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Security Policy (CSP) protection mechanism, making it easier for remote attackers to conduct CSRF attacks by reading an authentication token in a Referer header.
In phpMyAdmin versions 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3, a vulnerability allows remote attackers to cause a denial of service via a large array in the scripts parameter.
CVE-2016-2082 is a CSRF vulnerability in VMware vRealize Log Insight versions 2.x and 3.x before 3.3.2, allowing remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Cisco Cloud Network Automation Provisioner (CNAP) version 1.0(0) in Cisco Configuration Assistant (CCA) allows remote attackers to bypass intended filesystem and administrative-endpoint restrictions via GET API calls.
Cisco Firepower System Software versions 6.0.0 through 6.1.0 has a hardcoded account that allows remote attackers to gain CLI access if they know the password.
A vulnerability in Flexera InstallAnywhere related to an untrusted search path allows local users to gain privileges via a malicious DLL in the current working directory of a setup-launcher executable file.
IBM InfoSphere Streams before 4.0.1.2 and IBM Streams before 4.1.1.1 do not properly implement the runAsUser feature, allowing local users to obtain root group privileges via unspecified vectors.
Cisco Prime Infrastructure versions 1.2 through 3.1 and Evolved Programmable Network Manager versions 1.2 and 2.0 allow remote authenticated users to execute arbitrary commands or upload files via a crafted HTTP request.
CVE-2016-0386 describes a CSRF vulnerability in IBM TRIRIGA Application Platform that allows remote authenticated users to hijack the authentication of administrators for requests that delete employees. It affects versions before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2.
JMS Client in IBM MessageSight versions 1.1.x through 1.1.0.1, 1.2.x through 1.2.0.3, and 2.0.x through 2.0.0.0 allows remote authenticated users to obtain administrator privileges for executing arbitrary commands via unspecified vectors.
The builder tools in IBM TRIRIGA Application Platform versions 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allow remote authenticated users to gain privileges for application modification via unspecified vectors.
IBM TRIRIGA Application Platform versions 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allow remote authenticated users to conduct server-side request forgery (SSRF) attacks. Attackers can trigger network traffic to arbitrary intranet or Internet hosts via a crafted proxy request to a web service.
Multiple cross-site request forgery (CSRF) vulnerabilities in management scripts in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allow remote authenticated users to hijack the authentication of arbitrary users.