CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in Hyper-V on Microsoft Windows 8.1, Windows Server 2012 R2, and Windows 10 allows guest OS users to obtain sensitive information from host OS memory via a crafted application.
The Hyper-V vulnerability in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows guest OS users to obtain sensitive information from host OS memory via a crafted application.
The GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5H2 is vulnerable to remote attacks that can cause a denial of service via a crafted request.
The device management command line interface (CLI) in Palo Alto Networks PAN-OS before version 5.0.18 and in versions 5.1.x before 5.1.11, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5H2 allows remote authenticated administrators to execute arbitrary OS commands via an SSH command parameter.
Huawei Policy Center with software versions before V100R003C10SPC020 allows remote authenticated users to gain privileges and cause a denial of service (system crash) via a crafted URL.
CVE-2016-3172 is a SQL injection vulnerability in tree.php in Cacti version 0.8.8g and earlier. It allows remote authenticated users to execute arbitrary SQL commands via the parent_id parameter in an item_edit action.
The __switch_to function in the Linux kernel does not properly context-switch IOPL on 64-bit PV Xen guests, allowing local guest OS users to gain privileges, cause a denial of service (guest OS crash), or obtain sensitive information by leveraging I/O port access.
Apache Struts 2.x before version 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, known as forced double OGNL evaluation.
Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitrary code via vectors related to session data truncation.
The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or custom code that calls the user_save function with an explicit category and loads all roles into the array.
CVE-2016-3167 is a vulnerability in the drupal_goto function in Drupal 6.x before version 6.38 that allows open redirects. Attackers can exploit a double-encoded URL in the 'destination' parameter to redirect users to arbitrary websites.
The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, potentially allowing remote attackers to bypass intended access restrictions.
Drupal versions 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 may allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or (2) a form shown on a 404 error page, related to path manipulation.
The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks via a large number of calls made at once to the same method.
The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file uploaded to an unprocessed form by leveraging permission to create content or comment and upload files.
The Escape interface in the Kernel Mode Driver layer in the NVIDIA GPU graphics driver R340 before version 341.95 and R352 before version 354.74 on Windows allows local users to obtain sensitive information, cause a denial of service (crash), or gain privileges via unspecified vectors related to an untrusted pointer, leading to uninitialized or out-of-bounds memory access.
The Escape interface in the Kernel Mode Driver layer in the NVIDIA GPU graphics driver R340 before version 341.95 and R352 before version 354.74 on Windows allows local users to obtain sensitive information from kernel memory, cause a denial of service (crash), or possibly gain privileges via unspecified vectors, which trigger uninitialized or out-of-bounds memory access.
The Escape interface in the Kernel Mode Driver layer in the NVIDIA GPU graphics driver R340 before version 341.95 and R352 before version 354.74 on Windows improperly allows access to restricted functionality, which allows local users to gain privileges via unspecified vectors.
Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, allowing man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream.
The DNS::GetResult function in InspIRCd before version 2.0.19 allows remote DNS servers to cause a denial of service (netsplit) via an invalid character in a PTR response, as demonstrated by a "\032" (whitespace) character in a hostname.