CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Curve25519 code in Botan before version 1.11.31 may allow attackers to have unspecified impact on systems without a native 128-bit integer type, as demonstrated on 32-bit ARM systems compiled by Clang.
A stack-based buffer overflow in SAP NetWeaver versions 7.0 through 7.5 allows remote attackers to cause a denial of service by sending a crafted packet to the SAPSTARTSRV port.
Botan versions 1.11.x before 1.11.22 improperly handle wildcard matching against hostnames, which might allow remote attackers to have unspecified impact via a valid X.509 certificate.
Botan before 1.11.22 improperly validates certificate paths, allowing remote attackers to cause a denial of service via a certificate with a loop in the certificate chain.
Botan versions 1.11.x before 1.11.22 are vulnerable to a padding-oracle attack that allows remote attackers to decrypt TLS ciphertext data using CBC ciphersuites.
In ImageMagick version 7.0.4-9, an infinite loop can occur due to a floating-point rounding error in some color algorithms. This affects ModulateHSL, ModulateHCL, ModulateHCLp, ModulateHSB, ModulateHSI, ModulateHSV, ModulateHWB, ModulateLCHab, and ModulateLCHuv.
The Linux kernel up to version 4.10.9 has a vulnerability that allows attackers to cause a denial of service by triggering their own callback, leading to infinite recursion. This issue is present in the crypto/ahash.c file.
In Asterisk Open Source versions 13.x before 13.14.1 and 14.x before 14.3.1, as well as Certified Asterisk 13.13 before 13.13-cert3, remote code execution can occur due to a buffer overflow in a CDR user field, related to X-ClientCode in chan_sip, the CDR dialplan function, and the AMI Monitor action.
CVE-2017-6190 is a vulnerability in the web interface of the D-Link DWR-116 device with firmware before V1.05b09 that allows remote attackers to read arbitrary files via a '..' in a 'GET /uir/' request.
Impala in CDH versions 5.2.0 through 5.7.2 and 5.8.0 allows remote attackers to bypass Setry authorization.
Web2py versions before 2.14.6 do not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.
In KeePassX before version 0.4.4, a cleartext copy of password data is created upon canceling an XML export action. This allows attackers to obtain sensitive information by reading the .xml dotfile.
Opmantek NMIS before 4.3.7c has command injection vulnerabilities via the tools.pl CGI script using commands like man, finger, ping, trace, and nslookup. Versions before 8.5.12G may also be affected in non-default configurations.
CloudView NMS before 2.10a allows remote attackers to obtain sensitive information via a direct request for admin/auto.def.
CloudView NMS before version 2.10a has a format string issue that can be exploited over SNMP.
OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class.
Sierra Wireless GX 440 devices with ALEOS firmware version 4.3.2 execute the management web application as root.
Sierra Wireless GX 440 devices with ALEOS firmware version 4.3.2 store passwords in cleartext.
Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 use guessable session tokens, which are in the URL.
Sierra Wireless GX 440 devices with ALEOS firmware version 4.3.2 do not require authentication for Embedded_Ace_Get_Task.cgi requests.