CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unspecified vulnerability in HP KeyView before version 10.23.0.1 and 10.24.x before version 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors.
Unspecified vulnerability in HP KeyView before version 10.23.0.1 and 10.24.x before version 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors.
Unspecified vulnerability in HP KeyView before version 10.23.0.1 and 10.24.x before version 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors.
An unspecified vulnerability in HP KeyView before version 10.23.0.1 and 10.24.x before version 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors.
Unspecified vulnerability in HP KeyView before version 10.23.0.1 and 10.24.x before version 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors.
Unspecified vulnerability in HP KeyView before version 10.23.0.1 and 10.24.x before version 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors.
Unspecified vulnerability in HP KeyView before version 10.23.0.1 and 10.24.x before version 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors.
A memory leak in PolarSSL before version 1.3.9 allows remote attackers to cause a denial of service through a large number of ClientHello messages.
A memory leak in PolarSSL before 1.2.12 and 1.3.x before 1.3.9 allows remote attackers to cause a denial of service through a large number of crafted X.509 certificates.
SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL comment.
Multiple integer overflows in the evbuffer API in Libevent 2.0.x before 2.0.22 and 2.1.x before 2.1.5-beta may allow attackers to cause a denial of service or possibly have other unspecified impact via 'insanely large inputs'.
Red Hat OpenShift Enterprise 3.0.0.0 does not properly check permissions, allowing remote authenticated users with build permissions to execute arbitrary shell commands with root permissions on arbitrary build pods.
A memory leak in the virtual server component of F5 Big-IP allows remote attackers to exploit it. Attackers can cause a denial of service by sending a large number of crafted ICMP packets.
Multiple integer overflows in the evbuffer API in Libevent 1.4.x before 1.4.15, 2.0.x before 2.0.22, and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact via 'insanely large inputs'.
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
Use-after-free vulnerability in Adobe Flash Player before version 18.0.0.232 on Windows and OS X and before version 11.2.202.508 on Linux, as well as in Adobe AIR before version 18.0.0.199, allows attackers to execute arbitrary code via unspecified vectors.
In OpenSSH versions 6.8 and 6.9, sshd uses world-writable permissions for TTY devices, allowing local users to cause a denial of service (terminal disruption) or possibly have unspecified other impact by writing to a device.
CVE-2015-6564 is a use-after-free vulnerability in the mm_answer_pam_free_ctx function in sshd in OpenSSH before version 7.0 on non-OpenBSD platforms. It may allow local users to gain privileges by sending an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request.
MDI C4 OBD-II dongles with firmware 2.x and 3.4.x, used in products like Metromile Pulse, do not validate firmware updates. This allows remote attackers to execute arbitrary code by specifying an update server.
Mobile Devices (MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, used in Metromile Pulse and other products, have hardcoded SSH credentials, making it easier for remote attackers to gain access by leveraging knowledge of the required username and password.