CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The CoreUserInputHandler::doMode function in Quassel 0.10.0 allows remote attackers to cause an application crash via the "/op *" command in a query.
Juniper ScreenOS before version 6.3.0r21, when ssh-pka is configured and enabled, allows remote attackers to cause a denial of service (system crash) or execute arbitrary code via crafted SSH negotiation.
Fortinet FortiClient for Linux before build 2313, when installed in a home directory that is world readable and executable, allows local users to gain privileges via the helper/subroc setuid program.
Dell Pre-Boot Authentication Driver (PBADRV.sys) version 1.0.1.5 allows local users to write to arbitrary physical memory locations, potentially leading to privilege escalation.
Integer overflow in the read_string function in libsvn_ra_svn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to execute arbitrary code via an svn:// protocol string, which triggers a heap-based buffer overflow and an out-of-bounds read.
Buffer overflow in the CL_vsprintf function in Takumi Yamada DX Library before version 3.16 allows remote attackers to execute arbitrary code via a crafted string.
HPE UCMDB Browser before 4.02 allows remote attackers to obtain sensitive information or bypass intended access restrictions via unspecified vectors.
The Widevine QSEE TrustZone application in Android 5.x before 5.1.1 LMY49F and 6.0 before January 1, 2016, allows attackers to gain privileges via a crafted application that leverages QSEECOM access.
The prctl_set_vma_anon_name function in Android before version 5.1.1 LMY49F and 6.0 before January 1, 2016, does not ensure that only one vma is accessed in a certain update action, allowing attackers to gain privileges or cause a denial of service (vma list corruption) via a crafted application.
The Widevine QSEE TrustZone application in Android 5.x before version 5.1.1 LMY49F and 6.0 before January 1, 2016, allows attackers to gain privileges via a crafted application that leverages QSEECOM access.
The Imagination Technologies driver in Android 5.x before version 5.1.1 LMY49F and 6.0 before January 1, 2016, allows attackers to gain privileges via a crafted application.
The MediaTek misc-sd driver in Android before 5.1.1 LMY49F and 6.0 before January 1, 2016, allows attackers to gain privileges via a crafted application.
HPE Helion Eucalyptus versions 3.4.0 through 4.2.0 allow remote authenticated users to bypass an intended AssumeRole permission requirement and assume an IAM role by leveraging a policy setting for a user's account.
HPE Network Switches with software 15.16.x and 15.17.x allow local users to bypass intended access restrictions via unspecified vectors, which is a different vulnerability than CVE-2015-6859.
HPE Network Switches with software 15.16.x and 15.17.x allow local users to bypass intended access restrictions via unspecified vectors.
HP StoreOnce Backup system software before version 3.13.1 allows remote attackers to execute arbitrary code via unspecified vectors.
A cross-site request forgery (CSRF) vulnerability in HP StoreOnce Backup system software before version 3.13.1 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.
Cisco IOS XR versions 4.2.0, 4.3.0, 5.0.0, 5.1.0, 5.2.0, 5.2.2, 5.2.4, 5.3.0, and 5.3.2 do not properly restrict the number of Path Computation Elements (PCEs) for OSPF LSA opaque area updates, allowing remote attackers to cause a denial of service (device reload) via a crafted update.
IBM Connections versions 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 do not properly detect recursion during XML entity expansion. This allows remote attackers to cause a denial of service via a crafted XML document containing a large number of nested entity references.
The portal in IBM Tivoli Monitoring (ITM) versions 6.2.2 through FP9, 6.2.3 through FP5, and 6.3.0 before FP7 allows remote authenticated users to execute arbitrary commands by leveraging Take Action view authority and providing crafted input.