CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
IBM Tivoli Federated Identity Manager 6.2 is affected by a vulnerability due to a missing secure attribute in encrypted session (SSL) cookie.
IBM Sterling Order Management versions 9.2 through 9.5 is vulnerable to cross-site request forgery, which could allow an attacker to execute malicious and unauthorized actions on behalf of a trusted user.
IBM Rhapsody DM versions 4.0, 5.0, and 6.0 are vulnerable to a denial of service due to an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or exhaust all available memory resources.
IBM Tivoli Key Lifecycle Manager versions 2.0.1, 2.5, and 2.6 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.
The IP stack in multiple Huawei Campus series switch models allows remote attackers to cause a denial of service (reboot) via a crafted ICMP request message.
The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin versions 2.2.8 through 2.2.21 for WordPress allows remote attackers to read arbitrary WordPress option values.
AdBlock before 2.21 allows remote attackers to block arbitrary resources on arbitrary websites and to disable arbitrary blocking filters.
CVE-2015-1786 describes a CSRF vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before version 2.3.6, which can be exploited via null or malformed token identifiers.
The signal handler implementations in socat before version 1.7.3.0 and 2.0.0-b8 allow remote attackers to cause a denial of service (process freeze or crash).
Blue Coat Advanced Secure Gateway version 6.6, CacheFlow version 3.4, and ProxySG versions 6.5 and 6.6 allow remote attackers to bypass blocked requests, user authentication, and payload scanning.
In PHP versions 7.0.7 and 5.6.x, a vulnerability allows remote attackers to execute arbitrary code. This issue was introduced as part of an incomplete fix for CVE-2015-6833.
The vulnerability in ISurfaceComposer.cpp in Android allows attackers to trigger a denial of service through null pointer dereference, leading to process crashes.
VMware Horizon View Client versions 2.x, 3.x, and 4.x prior to 4.5.0 contain a command injection vulnerability in the service startup script. Successful exploitation of this issue may allow unprivileged users to escalate their privileges to root on the Mac OSX system where the client is installed.
CVE-2016-7050 affects the SerializableProvider component in RESTEasy, present in various versions of Red Hat Enterprise Linux. It allows remote attackers to execute arbitrary code.
389 Directory Server in Red Hat Enterprise Linux 6 and 7 allows remote attackers to read the default Access Control Instructions.
The 389 Directory Server in Red Hat Enterprise Linux (Desktop, HPC Node, Server, Workstation) versions 6 and 7 allows remote attackers to obtain user passwords.
The 389 Directory Server in Red Hat Enterprise Linux 6 and 7 allows remote attackers to infer the existence of RDN component objects.
mod_ns in Red Hat Enterprise Linux 7 allows remote attackers to force the use of ciphers that were not intended to be enabled.
ManageIQ in CloudForms before version 4.1 allows remote authenticated users to execute arbitrary code.