CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
EMC Unisphere for VMAX 8.x before 8.0.3.4 sets up the Java Debugging Wire Protocol (JDWP) service, allowing remote attackers to execute arbitrary code via unspecified vectors.
Directory traversal vulnerability in EMC Documentum Thumbnail Server allows remote attackers to bypass intended Content Server access restrictions. This affects versions 6.7SP1 before P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P01.
A race condition in the Performance Routing Engine (PRE) module in Cisco IOS 15.3S allows remote attackers to cause a denial of service by triggering module crashes.
Cisco Wireless LAN Controller (WLC) devices with software 7.0(240.0) allow local users to execute arbitrary OS commands in a privileged context via crafted CLI commands.
The add_job function in cupsd in CUPS before version 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, allowing remote attackers to trigger data corruption.
The XXE vulnerability in SAP Mobile Platform 3 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted XML request.
The Cross-System Tools and Data Transfer Workbench in SAP NetWeaver have hardcoded credentials, allowing remote attackers to gain access via unspecified vectors.
Cisco AnyConnect Secure Mobility Client 3.1(60) on Windows does not properly validate pathnames, allowing local users to gain privileges via a crafted INF file.
Cisco WebEx Meeting Center does not properly restrict the content of URLs in GET requests, allowing remote attackers to obtain sensitive information or conduct SQL injection attacks.
Adobe Photoshop CC before version 16.0 and Adobe Bridge CC before version 6.11 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
A heap-based buffer overflow in Adobe Photoshop CC before version 16.0 and Adobe Bridge CC before version 6.11 allows attackers to execute arbitrary code.
Integer overflow in Adobe Photoshop CC before version 16.0 and Adobe Bridge CC before version 6.11 allows attackers to execute arbitrary code via unspecified vectors.
Adobe Photoshop CC before 16.0 (aka 2015.0.0) allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVE-2015-2860 in Avigilon Control Center (ACC) 4 before version 4.12.0.54 and 5 before version 5.4.2.22 contains a directory traversal vulnerability. This allows remote attackers to read arbitrary files via a crafted help/ URL.
Aptexx Resident Anywhere does not require authentication, allowing remote attackers to obtain sensitive information or modify data via a direct request.
AudioShare version 2.0.2 contains a remote file inclusion vulnerability in ajax/myajaxphp.php, allowing attackers to execute arbitrary PHP code via a URL in the config['basedir'] parameter.
A memory leak in the Performance Routing Engine (PRE) module in Cisco IOS 15.3S allows remote attackers to cause a denial of service by triggering an error during CPE negotiation.
CVE-2015-4678 is an SQL injection vulnerability in Persian Car CMS 1.0 that allows remote attackers to execute arbitrary SQL commands via the cat_id parameter to the default URI.
Buffer overflow in the Tiny SRP library (aka TinySRP) allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted size value for the username field.
A stack-based buffer overflow exists in AirTies Air 6372, 5760, 5750, 5650TT, 5453, 5444TT, 5443, 5442, 5343, 5342, 5341, and 5021 DSL modems with firmware 1.0.2.0 and earlier. Remote attackers can execute arbitrary code via a long string in the redirect parameter to cgi-bin/login.