CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Node.js versions 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 do not ensure the availability of a parser for each HTTP socket, allowing remote attackers to cause a denial of service via a pipelined HTTP request.
Hadoop connector versions 1.1.1, 2.4, 2.5, and 2.7.0-0 before 2.7.0-3 for IBM Spectrum Scale and General Parallel File System (GPFS) allows local users to read or write to arbitrary GPFS data via unspecified vectors.
The CSRF vulnerability in Lotus Mashups in IBM Mashup Center 3.0.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
The Lotus Mashups component in IBM Mashup Center 3.0.0.1 allows remote authenticated users to cause a denial of service (CPU consumption) via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Buffer overflow in IBM i Access 7.1 on Windows allows local users to gain privileges via unspecified vectors.
The consoleinst.sh script in IBM Installation Manager before version 1.7.4.4 and 1.8.x before 1.8.4, as well as in Packaging Utility before version 1.7.4.4 and 1.8.x before 1.8.4, allows local users to gain privileges via a Trojan horse program located in /tmp with a name based on a predicted PID value.
The Data Protection extension in the VMware GUI in IBM Tivoli Storage Manager for Virtual Environments before version 7.1.4 and Tivoli Storage FlashCopy Manager for VMware before version 4.1.4 allows remote authenticated users to restore arbitrary virtual machines, potentially leading to the exposure of sensitive information.
IBM Security Access Manager for Web versions 7.0.0 before FP19, 8.0 before 8.0.1.3 IF3, and Security Access Manager 9.0 before 9.0.0.0 IF1 allows remote authenticated users to execute arbitrary OS commands by leveraging Local Management Interface (LMI) access.
The Health Check tool in IBM Sterling B2B Integrator 5.2 does not properly use cookies in conjunction with HTTPS sessions, allowing man-in-the-middle attackers to obtain sensitive information or modify data.
IBM SPSS Statistics versions 22.0.0.2 before IF10 and 23.0.0.2 before IF7 use weak permissions (Everyone: Write) for Python scripts, allowing local users to gain privileges by modifying a script.
Cross-site request forgery (CSRF) vulnerability on Belkin F9K1102 devices with firmware 2.10.17 allows remote attackers to hijack the authentication of arbitrary users.
Belkin F9K1102 devices with firmware 2.10.17 use an improper algorithm for selecting the ID value in the header of a DNS query, making it easier for remote attackers to spoof responses by predicting this value.
CVE-2015-1947 describes an untrusted search path vulnerability in IBM InfoSphere BigInsights 3.0, 3.0.0.1, 3.0.0.2, and 4.0, allowing local users to gain privileges via a Trojan horse library loaded by setuid or setgid programs.
CSRF vulnerability on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 allows remote attackers to hijack the authentication of arbitrary users.
The web administration interface on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 has a default password of 1234 for the admin account, allowing remote attackers to gain administrative privileges by leveraging a LAN session.
CSRF vulnerability in ReadyNet WRT300N-DD devices with firmware 1.0.26 allows remote attackers to hijack the authentication of arbitrary users.
The CSRF vulnerability on Amped Wireless R10000 devices with firmware 2.5.2.11 allows remote attackers to hijack the authentication of arbitrary users.
ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 allow remote authenticated users to obtain administrative privileges by leveraging access to the user account.
The management portal on ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 does not terminate sessions upon a logout action, allowing remote attackers to bypass intended access restrictions.
CSRF vulnerability in Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 allows remote attackers to hijack the authentication of arbitrary users.