CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Java client in the Adcon Telemetry A840 base station does not authenticate the station device, allowing man-in-the-middle attackers to spoof devices and obtain sensitive information by reading cleartext packet data, related to the lack of SSL support.
eWON devices with firmware before version 10.1s0 lack an off autocomplete attribute for the password field, making it easier for remote attackers to gain access by leveraging an unattended workstation.
The CSRF vulnerability in eWON devices with firmware up to version 10.1s0 allows remote attackers to hijack the authentication of administrators for requests that can lead to firmware uploads, removal of configuration data, or device reboots.
eWON devices with firmware before version 10.1s0 do not discard browser session data upon log-off, making it easier for remote attackers to gain access by leveraging an unattended workstation.
CSRF vulnerability in Motorola Solutions MOSCAD IP Gateway allows remote attackers to hijack the authentication of administrators for requests that modify a password.
Motorola Solutions MOSCAD IP Gateway allows remote attackers to read arbitrary files via unspecified vectors.
CVE-2015-7917 describes an untrusted search path vulnerability in Open Automation OPC Systems version 8.00.0023 and earlier, allowing local users to gain privileges via a Trojan horse DLL in an unspecified directory.
EMC Isilon OneFS versions 7.1 before 7.1.1.8, 7.2.0 before 7.2.0.4, and 7.2.1 before 7.2.1.1 allow remote authenticated administrators to bypass a SmartLock root-login restriction by creating a root account and establishing a login session.
A stack-based buffer overflow in the GoAhead Web Server on Schneider Electric Modicon M340 PLC BMXNOx and BMXPx devices allows remote attackers to execute arbitrary code via a long password in HTTP Basic Authentication data.
Honeywell Midas gas detectors before 1.13b3 and Midas Black gas detectors before 2.13b3 allow remote attackers to discover cleartext passwords by sniffing the network.
CVE-2015-7907 describes a directory traversal vulnerability in the web server of Honeywell Midas gas detectors before version 1.13b3 and Midas Black before version 2.13b3. It allows remote attackers to bypass authentication and write to a configuration file or trigger calibration or testing.
LOYTEC LIP-3ECTB 6.0.1, LINX-100, LVIS-3E100, and LIP-ME201 devices allow remote attackers to read a password-hash backup file via unspecified vectors.
The login function in the RequestController class in Moxa OnCell Central Manager before version 2.2 has a hardcoded root password, allowing remote attackers to gain administrative access via a login session.
The MessageBrokerServlet servlet in Moxa OnCell Central Manager before version 2.2 does not require authentication, allowing remote attackers to gain administrative access via a command, such as the addUserAndGroup action.
Apache HBase versions before 0.98.12.1, 1.0.1.1, and 1.1.0.1, as used in IBM InfoSphere BigInsights, have incorrect ACLs for ZooKeeper coordination state. This allows remote attackers to cause a denial of service, obtain sensitive information, or modify data via unspecified client traffic.
The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2, mishandles simple unauthenticated and anonymous bind configurations, allowing remote attackers to bypass authentication via a crafted LDAP request.
Serialized-object interfaces in VMware vRealize Orchestrator 6.x, vCenter Orchestrator 5.x, vRealize Operations 6.x, vCenter Operations 5.x, and vCenter Application Discovery Manager 7.x allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
Cisco Prime Network Services Controller version 3.0 allows local users to bypass intended access restrictions and execute arbitrary commands via additional parameters to an unspecified command.
The boot manager in Cisco Application Policy Infrastructure Controller (APIC) version 1.1(0.920a) allows local users to bypass intended access restrictions and obtain single-user-mode root access via unspecified vectors.
The SysAdminWebTool servlets in SAP Mobile Platform allow remote attackers to bypass authentication, enabling them to obtain sensitive information, gain privileges, or have unspecified other impacts.