CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unspecified vulnerability in HP Intelligent Management Center (iMC) before version 7.0 E02020P03 and Branch Intelligent Management System (BIMS) before version 7.0 E0201P02 allows remote authenticated users to obtain sensitive information or modify data via unknown vectors.
Unspecified vulnerability in HP Intelligent Management Center (iMC) before version 7.0 E02020P03 and Branch Intelligent Management System (BIMS) before version 7.0 E0201P02 allows remote attackers to obtain sensitive information via unknown vectors.
Unspecified vulnerability in HP Intelligent Management Center (iMC) before version 7.0 E02020P03 and Branch Intelligent Management System (BIMS) before version 7.0 E0201P02 allows remote attackers to obtain sensitive information via unknown vectors.
Unspecified vulnerability in HP Intelligent Management Center (iMC) before version 7.0 E02020P03 and Branch Intelligent Management System (BIMS) before version 7.0 E0201P02 allows remote attackers to obtain sensitive information via unknown vectors.
Unspecified vulnerability in HP Intelligent Management Center (iMC) before version 7.0 E02020P03 and Branch Intelligent Management System (BIMS) before version 7.0 E0201P02 allows remote attackers to obtain sensitive information via unknown vectors.
An unspecified vulnerability in HP StoreVirtual 4000 Storage and StoreVirtual VSA versions 9.5 through 11.0 allows remote authenticated users to gain privileges via unknown vectors.
Infoblox NetMRI before 6.8.5 has a default password of 'admin' for the 'root' MySQL database account, making it easier for local users to gain access via unspecified vectors.
In Infoblox NetMRI before version 6.8.5, a vulnerability allows remote attackers to execute arbitrary commands via shell metacharacters in the skipjackUsername parameter.
Raritan PX before 1.5.11 on DPXR20A-16 devices allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password.
Datum Systems SnIP devices on PSM-500 and PSM-4500 have a hardcoded password of 'admin' for the admin account, making it easier for remote attackers to gain access via unspecified vectors.
Datum Systems SnIP on PSM-500 and PSM-4500 devices does not require authentication for FTP sessions, allowing remote attackers to obtain sensitive information via RETR commands.
The WP Rss Poster plugin version 1.0.0 for WordPress has an SQL injection vulnerability. Remote attackers can execute arbitrary SQL commands via the id parameter on the wrp-add-new page in the admin panel.
Juniper Junos versions before 11.4R12, 12.1R10, 12.1X44-D35, 12.1X45-D25, 12.1X46-D20, 12.1X47-D10, 12.2R8, 12.3R7, 13.1R4, 13.2R4, 13.3R2, and 14.1R1 with Auto-RP enabled are vulnerable to an attack that can cause a denial of service (RDP routing process crash and restart) via a malformed PIM packet.
On SRX Series devices running Juniper Junos versions before 11.4R12, 12.1X44 before 12.1X44-D32, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, and 12.1X47 before 12.1X47-D10, enabled NAT protocol translation from IPv4 to IPv6 may allow remote attackers to cause a denial of service (flowd hang or crash) via a crafted packet.
Juniper Junos versions before 11.4R12, 12.1R11, 12.1X44-D35, 12.1X45-D30, 12.1X46-D20, 12.1X47-D10, 12.2R8-S2, 12.3R7, 13.1R4-S2, 13.2R5, 13.3R2-S2, and 14.1R1 allow remote authenticated users to gain privileges via unspecified combinations of CLI commands and arguments.
A vulnerability in Juniper Junos 12.1X46 before version 12.1X46-D20 and 12.1X47 before version 12.1X47-D10 on SRX Series devices allows remote attackers to cause a denial of service (flowd crash) via a crafted SIP packet.
Dahua DVR versions 2.608.0000.0 and 2.608.GV00.0 allow remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions.
Docker version 1.0.0 uses world-readable and world-writable permissions on the management socket, allowing local users to gain privileges via unspecified vectors.
SQL injection vulnerability in admin/uploads.php in AtomCMS, possibly version 2.0, allows remote attackers to execute arbitrary SQL commands via the id parameter.
SQL injection vulnerability in index.php in FoeCMS allows remote attackers to execute arbitrary SQL commands via the i parameter.