CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2016-2389 is a vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4, allowing remote attackers to read arbitrary files via a .. (dot dot) in the Path parameter to /Catalog.
Podatność na przejście do katalogu w Action View w Ruby on Rails przed wersją 3.2.22.1, 4.0.x i 4.1.x przed 4.1.14.1, 4.2.x przed 4.2.5.1 oraz 5.x przed 5.0.0.beta1.1 pozwala zdalnym atakującym na odczyt dowolnych plików poprzez wykorzystanie nieograniczonego użycia metody render i podanie .. (kropka kropka) w ścieżce.
In Action Pack in Ruby on Rails before version 3.2.22.1, and 4.0.x, 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1, there is an issue with properly restricting the use of the MIME type cache. This allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.
Action Pack in Ruby on Rails versions 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 has a vulnerability that allows remote attackers to cause a denial of service through the use of a wildcard controller route, leading to superfluous caching and memory consumption.
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service via an invalid pointer dereference, leading to a worker process crash.
IBM WebSphere Portal versions 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF20, and 8.5.0 before CF10 are vulnerable to LDAP injection attacks, allowing remote attackers to read or write to repository data.
CVE-2015-5050 describes a cross-site request forgery (CSRF) vulnerability in IBM Emptoris Contract Management that allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
IBM Emptoris Contract Management versions 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4, and 10.0.4.x before 10.0.4.0 iFix3 allows remote attackers to execute arbitrary code by including a crafted Flash file.
The SSH implementation on IBM Security Access Manager for Web before version 7.0.0 FP19, 8.0 before 8.0.1.3 IF3, and 9.0 before 9.0.0.0 IF1 does not properly restrict the set of MAC algorithms, making it easier for remote attackers to defeat cryptographic protection mechanisms.
IBM Security Access Manager for Web versions 7.0 before 7.0.0 IF21, 8.0 before 8.0.1.3 IF4, and 9.0 before 9.0.0.1 IF1 lacks a lockout mechanism for invalid login attempts, making it easier for remote attackers to gain access via a brute-force attack.
The Web UI in IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 allows remote authenticated users to execute unspecified OS commands via unknown vectors.
The Developer Tools subsystem in Google Chrome before version 48.0.2564.109 does not validate URL schemes, allowing remote attackers to bypass intended access restrictions via a crafted URL.
An integer underflow in the ProcessCommandsInternal function in dec/decode.c in Brotli, as used in Google Chrome before version 48.0.2564.109, allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted data with brotli compression.
The DOM implementation in Google Chrome before version 48.0.2564.109 does not properly restrict frame-attach operations from occurring during or after frame-detach operations. This allows remote attackers to bypass the Same Origin Policy via a crafted website.
The Extensions subsystem in Google Chrome before version 48.0.2564.109 does not prevent the use of the Object.defineProperty method to override intended extension behavior, allowing remote attackers to bypass the Same Origin Policy via crafted JavaScript code.
Mozilla Firefox before 44.0.2 does not properly restrict the interaction between Service Workers and plugins, allowing remote attackers to bypass the Same Origin Policy via a crafted website.
The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value. This allows remote attackers to obtain sensitive information or cause a denial of service via a crafted Graphite smart font.
CVE-2016-1525 is a vulnerability in the NETGEAR Management System NMS300 version 1.5.0.11 and earlier that allows for directory traversal. Remote authenticated users can read arbitrary files by using the '..' sequence in the realName parameter.
In the Libgraphite library in Graphite 2 version 1.2.4, used in Mozilla Firefox before version 43.0 and Firefox ESR 38.x before version 38.6.1, recursive load calls are not considered during size checks. This can lead to denial of service (heap-based buffer overflow) or potentially allow arbitrary code execution via a crafted Graphite smart font.
The directrun function in directmachine.cpp in Libgraphite in Graphite 2 version 1.2.4, as used in Mozilla Firefox before version 43.0 and Firefox ESR 38.x before version 38.6.1, does not validate a certain skip operation. This allows remote attackers to execute arbitrary code, obtain sensitive information, or cause a denial of service via a crafted Graphite smart font.