CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A memory leak in Huawei AR3200 before V200R007C00SPC900 can be exploited by remote attackers. Attackers can cause a denial of service by sending a large number of crafted MPLS packets.
Lenovo Solution Center (LSC) before 3.3.003 allows local users to execute arbitrary code with LocalSystem privileges. This is exploited via the StartProxy command of the LSC.Services.SystemService with a previously created named pipe and a crafted .NET assembly.
Huawei Mate8 versions before NXT-AL10C00B182, NXT-CL00C92B182, NXT-DL00C17B182, and NXT-TL00C01B182 allow attackers to bypass permission checks and delete user data via a crafted app.
Huawei Mate8 versions NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 allow attackers to bypass permission checks and control partial module functions via a crafted app.
The image build process for overcloud images in Red Hat OpenStack Platform 8.0 and Red Hat Enterprise Linux OpenStack Platform 7.0 uses a default root password 'ROOTPW', allowing attackers to gain access.
WordPress versions before 4.5.3 allow remote attackers to bypass the sanitize_file_name protection mechanism via unspecified vectors.
WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie.
WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors.
The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors.
WordPress versions before 4.5.3 allow remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php.
The customizer in WordPress before 4.5.3 allows remote attackers to bypass intended redirection restrictions via unspecified vectors.
Unspecified vulnerability in Opera Mail before 2016-02-16 on Windows allows user-assisted remote attackers to execute arbitrary code via a crafted e-mail message.
Integer overflow in the snd_compr_allocate_buffer function in the ALSA subsystem in the Linux kernel before version 3.6-rc6-next-20120917 may lead to insufficient memory allocation, resulting in denial of service.
The Java Console in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6, when a certain unsupported configuration involving UNC share pathnames is used, allows remote attackers to bypass authentication and possibly execute arbitrary code.
IBM UrbanCode Deploy versions 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 allow remote authenticated users to obtain sensitive cleartext secure-property information via the server UI or a database request.
IBM Spectrum Scale versions 4.1 before 4.1.1.5 and 4.2 before 4.2.0.2, as well as General Parallel File System version 3.5 before 3.5.0.30, allow local users to gain privileges or cause a denial of service via a crafted mmapplypolicy command.
A memory leak in queue-manager agents in IBM WebSphere MQ 8.x before version 8.0.0.5 allows remote attackers to cause a denial of service by triggering many errors.
CA Release Automation versions 5.0.2 before 5.0.2-227, 5.5.1 before 5.5.1-1616, 5.5.2 before 5.5.2-434, and 6.1.0 before 6.1.0-1026 allow remote attackers to read arbitrary files or cause a denial of service via a request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVE-2016-0233 is an SQL injection vulnerability in IBM Marketing Platform 8.5.x, 8.6.x, and 9.x before version 9.1.2.2 that allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Multiple heap-based buffer overflows in the hiddev_ioctl_usage function in the Linux kernel through version 4.6.3 may lead to denial of service or other unspecified impacts. The issue occurs with crafted HIDIOCGUSAGES or HIDIOCSUSAGES ioctl calls.