CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In versions 4.1.19.2 and earlier of Invision Power Services (IPS) Community Suite, there is a combination of Stored XSS and Information Disclosure vulnerabilities in the attachments feature found in User CP. This can be triggered by any Invision Power Board user and can lead to gaining access to moderator/admin accounts.
In versions 4.1.19.2 and earlier of Invision Power Services (IPS) Community Suite, there is a stored XSS vulnerability in the Announcements section, allowing privilege escalation from an Invision Power Board moderator to an admin. The attack uses the announce_content parameter in an index.php?/modcp/announcements/&action=create request.
The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, AAM, AFM, APM, ASM, GTM, Link Controller, PEM, PSM, and WebSafe 11.6.0 before 11.6.0 HF6, 11.5.0 before 11.5.3 HF2, and 11.3.0 before 11.4.1 HF10 may suffer from a memory leak while handling certain types of TCP traffic. Remote attackers may cause a denial of service (DoS) by way of a crafted TCP packet.
Symantec Advanced Secure Gateway (ASG) and ProxySG versions prior to 6.6.5.13, 6.7.3.1, and 6.5.10.6 are susceptible to an information disclosure vulnerability. An attacker with local access to the client host of an authenticated administrator user can obtain sensitive authentication credential information under certain circumstances.
The management consoles of Symantec Advanced Secure Gateway (ASG) and ProxySG in versions prior to 6.6.5.8, 6.5 prior to 6.5.10.6, and 6.7 prior to 6.7.1.2 do not correctly authorize administrator users under certain circumstances. A malicious administrator with read-only access can exploit this vulnerability to access management console functionality that requires read-write access privileges.
The management console of Symantec Content Analysis (CA) versions 1.3, 2.x prior to 2.2.1.1, and Mail Threat Defense (MTD) version 1.1 is susceptible to a cross-site request forging (CSRF) vulnerability. A remote attacker can use phishing or other social engineering techniques to access the management console with the privileges of an authenticated administrator user.
A potential security vulnerability has been identified with HP Integrated Lights-Out 4 (iLO 4) firmware version 2.11 and later, but prior to version 2.30. The vulnerability could be exploited remotely resulting in Denial of Service (DoS).
Integer signedness error in MiniUPnP MiniUPnPc v1.4.20101221 through v2.0 allows remote attackers to cause a denial of service or possibly have unspecified other impact.
Mozilla Network Security Services (NSS) versions before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 are vulnerable to remote attacks that can cause denial of service (out-of-bounds write) or possibly have unspecified other impact by leveraging incorrect base64 operations.
In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160, and 16 before FP1, there is a use-after-free vulnerability in multiple agents that can lead to a denial of service or remote code execution.
SAP SAPCAR version 721.510 has a Heap Based Buffer Overflow Vulnerability. It could be exploited with a crafted CAR archive file received from an untrusted remote source.
The inet_csk_clone_lock function in the Linux kernel up to version 4.10.15 allows attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging the accept system call.
Dolibarr ERP/CRM version 4.0.4 stores passwords using the MD5 algorithm, making brute-force attacks easier.
Dolibarr ERP/CRM version 4.0.4 has an SQL Injection vulnerability in doli/theme/eldy/style.css.php via the lang parameter.
A Use After Free vulnerability in the pdf2swf part of swftools 0.9.2 and earlier allows remote attackers to execute arbitrary code via a malformed PDF document.
Airwatch Agent for Android contains a vulnerability that may allow a device to bypass root detection. Successful exploitation of this issue may result in an enrolled device having unrestricted access over local Airwatch security controls and data.
IBM WebSphere Application Server versions 8.0 and 8.5.5 may provide weaker than expected security. A remote attacker could exploit this weakness to obtain sensitive information and gain unauthorized access to the admin console.
IBM Team Concert (RTC) is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources.
In F5 BIG-IP versions 11.2.1, 11.4.0 through 11.6.1, and 12.0.0 through 12.1.2, an unauthenticated user with access to the control plane may be able to delete arbitrary files through an undisclosed mechanism.
IBM Interact versions 8.6, 9.0, 9.1, and 10.0 are vulnerable to cross-site request forgery, which could allow an attacker to execute malicious and unauthorized actions on behalf of a trusted user.