CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The XHCI controller in VMware ESXi 6.5 and earlier versions has an issue with uninitialized memory usage. This may allow a guest to execute code on the host, posing a serious security risk.
VMware ESXi versions 6.5, 6.0 U3, 6.0 U2, 6.0 U1, and 5.5, as well as Workstation Pro / Player 12.x and Fusion Pro / Fusion 8.x prior to specified versions, have an uninitialized stack memory usage in SVGA. This issue may allow a guest to execute code on the host.
VMware ESXi 6.5 and 5.5, as well as Workstation Pro / Player 12.x and Fusion Pro / Fusion 8.x, have a Heap Buffer Overflow vulnerability in the SVGA driver. This issue may allow a guest to execute code on the host.
VMware Workstation Pro/Player 12.x before version 12.5.3 contains a DLL loading vulnerability due to the 'vmware-vmx' process loading DLLs from a path defined in the local environment variable. Successful exploitation of this issue may allow normal users to escalate privileges to System on the host machine where VMware Workstation is installed.
VMware vSphere Data Protection (VDP) versions 6.1.x, 6.0.x, 5.8.x, and 5.5.x locally stores vCenter Server credentials using reversible encryption. This may allow plaintext credentials to be obtained.
VMware vSphere Data Protection (VDP) versions 6.1.x, 6.0.x, 5.8.x, and 5.5.x contain a deserialization issue. Exploitation of this issue may allow a remote attacker to execute commands on the appliance.
IBM BigFix Compliance version 1.9.70 does not require strong passwords by default, making it easier for attackers to compromise user accounts.
IBM Maximo Asset Management versions 7.1, 7.5, and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session.
IBM Domino versions 8.5 and 9.0 could allow an attacker to steal credentials using multiple sessions and large amounts of data via Domino TLS Key Exchange validation.
In ARM Trusted Firmware through 1.3, the secure self-hosted invasive debug interface allows normal world attackers to cause a denial of service (secure world panic) via vectors involving debug exceptions and debug registers.
In ARM Trusted Firmware 1.3, RO memory is always executable at AArch64 Secure EL1, allowing attackers to bypass the MT_EXECUTE_NEVER protection mechanism. This issue occurs due to inconsistency in the number of execute-never bits (one bit versus two bits).
CVE-2015-7888 describes a directory traversal vulnerability in the WifiHs20UtilityService on the Samsung S6 Edge that allows remote attackers to overwrite or create arbitrary files as the system-level user.
AMD fglrx-driver before version 15.9 allows local users to gain privileges via a symlink attack. This vulnerability exists due to an incomplete fix for CVE-2015-7723.
AMD fglrx driver before version 15.7 allows local users to gain privileges via a symlink attack.
The XXE vulnerability in Milton Webdav before version 2.7.0.3 allows an attacker to exploit external XML entities to gain access to system data.
An issue was discovered in Personify360 e-Business versions 7.5.2 through 7.6.1 that allows access to a list of database tables and their columns when creating a new role at the /TabId/275 URI.
An issue was discovered in Personify360 e-Business versions 7.5.2 through 7.6.1 that allows reading customer data such as name, master Customer Id, and email address by accessing the /TabId/275 URI. No authentication is required, enabling anyone to search for users in the system.
An issue was discovered in Personify360 e-Business versions 7.5.2 through 7.6.1 that allows anyone to add a vendor account or read existing vendor account data, including usernames and passwords, by accessing the /TabId/275 URI.
In Irssi before version 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory. This may lead to application crashes.
In Irssi before version 1.0.3, when receiving a DCC message without source nick/host, it attempts to dereference a NULL pointer. This can lead to application crashes.