CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Directory traversal vulnerability in WebManager in NEC EXPRESSCLUSTER X allows remote attackers to read arbitrary files. This affects versions 3.3 11.31 on Windows and 3.3 3.3.1-1 on Linux and Solaris.
A cross-site request forgery (CSRF) vulnerability exists in KDDI HOME SPOT CUBE devices before version 2, allowing remote attackers to hijack the authentication of unspecified victims via unknown vectors.
There is an open redirect vulnerability in KDDI HOME SPOT CUBE devices before version 2 that allows remote attackers to redirect users to arbitrary websites.
CAREL PlantVisorEnhanced allows remote attackers to bypass intended access restrictions via a direct file request.
The web GUI on Cisco Small Business 500 devices version 1.2.0.92 is vulnerable to denial of service attacks via a crafted HTTP request.
Intel Driver Update Utility before version 2.4 retrieves driver updates in cleartext, making it easier for man-in-the-middle attackers to execute arbitrary code via a crafted file.
The ConnectionExists function in lib/url.c in libcurl before version 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request.
OpenStack Object Storage (Swift) before 2.3.1 (Kilo), 2.4.x, and 2.5.x before 2.5.1 (Liberty) do not properly close server connections, allowing remote attackers to cause a denial of service via a series of interrupted requests to a Large Object URL.
OpenStack Object Storage (Swift) before version 2.4.0 does not properly close client connections, allowing remote attackers to cause a denial of service via a series of interrupted requests to a Large Object URL.
A stack-based buffer overflow exists in McAfee File Lock 5.x in McPvDrv.sys 4.6.111.0, which can lead to a system crash. Attackers can exploit a long vault GUID in an ioctl call to cause a denial of service.
The authorization framework in Apache Hive versions 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0, and 1.2.1 allows attackers to bypass intended parent table access restrictions via unspecified partition-level operations.
FreeBSD versions 9.3 before p33, 10.1 before p26, and 10.2 before p9 allow remote attackers to cause a denial of service (kernel crash) via vectors related to creating a TCP connection with the TCP_MD5SIG and TCP_NOOPT socket options.
The SCTP module in FreeBSD 9.3 before p33, 10.1 before p26, and 10.2 before p9, when the kernel is configured for IPv6, allows remote attackers to cause a denial of service via a crafted ICMPv6 packet.
Directory traversal vulnerability in the set_skin function in rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated users with certain permissions to read arbitrary files or possibly execute arbitrary code via a .. (dot dot) in the _skin parameter to index.php.
Report Builder in IBM Jazz Reporting Service (JRS) versions 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 is vulnerable to an attack that can cause a Report Builder server outage via a crafted request to a Report Builder instance URL.
The vulnerability in the CIFS optimization functionality on Cisco WAAS and vWAAS devices before version 5.3.5d and 5.4 and 5.5 before version 5.5.3 allows remote attackers to cause a denial of service via crafted network traffic.
The client_host function in parsers.c in Privoxy before version 3.0.24 allows remote attackers to cause a denial of service (invalid read and crash) via an empty HTTP Host header.
The remove_chunked_transfer_coding function in Privoxy before version 3.0.24 allows remote attackers to cause a denial of service (invalid read and crash) via crafted chunk-encoded content.
The Montgomery code in the math/big library in Go 1.5.x before version 1.5.3 mishandles carry propagation, leading to incorrect output. This makes it easier for attackers to obtain private RSA keys via unspecified vectors.
Chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key.