CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CloudForms Management Engine before version 5.8 includes a default SSL/TLS certificate.
The PooledInvokerServlet in JBoss EAP 4.x and 5.x allows remote attackers to execute arbitrary code via a crafted serialized payload.
In Pulp before version 2.8.3, the consumer private key is written to etc/pki/pulp/consumer/consumer-cert.pem with world-readable permissions. This allows remote authenticated users to obtain the consumer private keys and escalate privileges.
The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak keys or write to arbitrary files via a symlink attack.
Cloud Foundry Diego versions 0.1468.0 through 0.1470.0 allow remote attackers to cause a denial of service.
SQL injection vulnerability in ClearPass Policy Manager versions 6.5.x through 6.5.6 and 6.6.0.
The user module in Ansible before version 1.6.6 allows remote authenticated users to execute arbitrary commands.
The ASN.1 parser in strongSwan before version 5.5.3 improperly handles CHOICE types when the x509 plugin is enabled, allowing remote attackers to cause a denial of service (infinite loop) via a crafted certificate.
The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpz_powm_sec, allowing remote peers to cause a denial of service (floating point exception and process crash) via a crafted certificate.
Unspecified tests in Lynis before 2.5.0 allow local users to write to arbitrary files or possibly gain privileges via a symlink attack on a temporary file.
Red5 Media Server versions before 1.0.8 have an issue with deserialization as they do not restrict the classes for which deserialization is performed. This allows remote attackers to execute arbitrary code via crafted Java data.
The user authentication module in Huawei Campus switches S5700, S5300, S6300, and S6700 with software before V200R001SPH012 and S7700, S9300, and S9700 with software before V200R001SPH015 allows remote attackers to cause a denial of service (device restart) via vectors involving authentication, which trigger an array access violation.
Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to execute arbitrary code with root privileges via a crafted UDS patch with shell scripts.
The DeviceManager in Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to obtain sensitive information via a crafted UDS patch with JavaScript.
Seagate Business NAS devices with firmware before version 2015.00322 allow remote attackers to execute arbitrary code with root privileges by leveraging the use of a static encryption key to create session tokens.
Atmail before 7.8.0.2 has a CSRF vulnerability, allowing an attacker to create a user account.
Atmail before 7.8.0.2 has a CSRF vulnerability, allowing an attacker to change the SMTP hostname and hijack all emails.
Atmail before 7.8.0.2 has a CSRF vulnerability, allowing an attacker to upload and import users via CSV.
A vulnerability in the SIP protocol of Cisco TelePresence Codec and Collaboration Endpoint software could allow an unauthenticated, remote attacker to cause a TelePresence endpoint to reload unexpectedly, resulting in a denial of service (DoS) condition. The issue is due to a lack of flow-control mechanisms within the software.
A vulnerability in Cisco Prime Data Center Network Manager (DCNM) Software allows an unauthenticated, remote attacker to log in to the administrative console of a DCNM server using an account with a default, static password. This account may have root or system-level privileges.