CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Race condition in `check.jst` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote attacker to gain unauthorized access via concurrent authentication requests that exploit shared authentication state.
Improper cryptographic signature verification in `jst_functions.c` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote attacker to bypass authentication and obtain administrative access via a forged JWT containing an invalid RSA signature.
IBM PowerVM Hypervisor in specific versions has a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash with possible memory corruption during system initialization.
IBM Power Systems Firmware in specific versions has a vulnerability in partition firmware during network boot. An unauthenticated attacker on the same network as a partition undergoing network boot can send a malformed packet, allowing arbitrary code execution in the partition firmware and compromising everything subsequently loaded by that partition.
This candidate has been rejected. It is a reservation duplicate of CVE-2026-32475. Users should reference CVE-2026-32475 instead of this candidate.
IBM Power Systems Firmware in specific versions has a vulnerability in partition firmware during network boot. An unauthenticated attacker on the same network as a partition performing a network boot can prevent that partition from completing its boot sequence, and if secure boot is not enabled, can substitute the boot image, compromising everything subsequently loaded.
IBM PowerVM Hypervisor in specific versions has a vulnerability in the hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call causing a virtual processor to become permanently unresponsive, requiring a full platform re-IPL to restore normal operation.
IBM PowerVM Hypervisor in specific versions has a vulnerability in the hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call to inject an arbitrary amount of data into hypervisor or partition memory, resulting in either a crash requiring a full platform re-IPL or memory corruption.
IBM Power Systems Firmware in specific versions has a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can access and disrupt host processor state, potentially affecting the managed system and all hosted partitions.
IBM Power Systems Firmware in specific versions has a vulnerability in host firmware NVRAM parsing. An attacker with root access to a guest partition on an OpenPOWER system can write a specially crafted NVRAM image, causing the host firmware boot stage to crash with possible memory corruption, requiring operator intervention to restore normal operation.
IBM PowerVM Hypervisor in specific versions has a vulnerability in partition firmware during network boot. An unauthenticated attacker with network access can prevent a partition undergoing iSCSI SAN network boot from completing its boot sequence, causing availability impact only to that partition.
IBM Power Systems Firmware in specific versions has a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can read and write arbitrary regions of host system memory, giving full control over the host system and all hosted partitions.
IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper validation of network-supplied pointers.
IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an integer overflow.
IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 have a vulnerability that could allow a local attacker to execute arbitrary code due to an out-of-bounds write.
IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow.
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack buffer overflow.
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an off-by-one error in bounds checking.
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code or cause a denial of service due to an out-of-bounds write.
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.