CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to discover the PHP JSESSIONID value via unspecified vectors.
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to discover credentials via a brute-force attack.
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to bypass the Authentication Lock protection mechanism. This enables brute-force password-guessing attacks against management-console accounts.
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, enabling them to trigger network traffic to arbitrary intranet hosts via a crafted request.
The AntiVirus Decomposer engine in various Symantec products contains a vulnerability that could lead to unauthorized access or execution of malicious code. This affects multiple software versions, including Symantec Advanced Threat Protection and Symantec Endpoint Protection.
The AntiVirus Decomposer engine in various Symantec products contains a vulnerability that may lead to unauthorized access or execution of malicious code. This affects multiple software versions, including Symantec Advanced Threat Protection and Symantec Endpoint Protection.
The AntiVirus Decomposer engine in various Symantec products contains a vulnerability that could lead to unauthorized access or execution of malicious code. This affects multiple software versions, including Symantec Advanced Threat Protection and Symantec Endpoint Protection.
Buffer overflow in Dec2LHA.dll in the AntiVirus Decomposer engine in various Symantec products may lead to unauthorized access or execution of malicious code. This affects multiple versions of Symantec Advanced Threat Protection, Symantec Endpoint Protection, and other products.
Buffer overflow in Dec2SS.dll in the AntiVirus Decomposer engine in various Symantec products, which may lead to unauthorized access or execution of malicious code.
The AntiVirus Decomposer engine in various Symantec products contains a vulnerability that could lead to unauthorized access or execution of malicious code. This affects versions of Symantec Advanced Threat Protection, Symantec Data Center Security, Symantec Endpoint Protection, and other products prior to specified update versions.
HAproxy 1.6.x before 1.6.6, when a deny comes from a reqdeny rule, allows remote attackers to cause a denial of service (uninitialized memory access and crash) or possibly have unspecified other impact via unknown vectors.
The parse_chunk_header function in libtorrent before version 1.1.1 allows remote attackers to cause a denial of service (crash) via a crafted HTTP response or possibly a UPnP broadcast.
F5 BIG-IP versions before 12.0.0 HF3 allow remote authenticated users to modify the account configuration of users with the Resource Administration role, potentially gaining privileges via a crafted external Extended Application Verification (EAV) monitor script.
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.
CRLF injection vulnerability in the send email functionality in dotCMS before 3.3.2 allows remote attackers to inject arbitrary email headers via CRLF sequences in the subject.
The overflow protection in Expat is removed by compilers with certain optimization settings, allowing remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data.
Version 2.6.7 of Symphony CMS contains a session fixation vulnerability when session.use_only_cookies is disabled. This allows remote attackers to hijack web sessions via the PHPSESSID parameter.
Dnsmasq before 2.76 allows remote servers to cause a denial of service (crash) via a reply with an empty DNS address that has an (1) A or (2) AAAA record defined locally.
The vulnerability in hotfix_upload.cgi in Trend Micro Deep Discovery Inspector (DDI) 3.7, 3.8 SP1, and 3.8 SP2 allows remote administrators to execute arbitrary code via shell metacharacters in the filename parameter of the Content-Disposition header.
Lenovo BIOS EFI Driver allows local administrators to execute arbitrary code with System Management Mode (SMM) privileges via unspecified vectors.