CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CSRF exists on D-Link DIR-600M Rev. Cx devices before v3.05ENB01_beta_20170306. This can be used to bypass authentication and insert XSS sequences or possibly have unspecified other impact.
An issue was discovered in exception_wrapper.py in OpenStack Nova versions 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens.
A vulnerability in the Autonomic Networking Infrastructure (ANI) registrar feature of Cisco IOS and Cisco IOS XE software could allow an unauthenticated attacker to cause a denial of service (DoS) condition. The issue is due to incomplete input validation on certain crafted packets.
An SSL Stripping vulnerability in EMC RecoverPoint versions prior to 5.0 and EMC RecoverPoint for Virtual Machines versions prior to 5.0 allows attackers to intercept and modify SSL traffic, potentially compromising the affected system.
A Cross-Site Request Forgery issue was identified in Meteocontrol WEB'log (all versions). The lack of CSRF token generation per page or function increases the risk of attacks.
The decode_residual function in libavcodec in libav 9.21 allows remote attackers to cause a denial of service (buffer over-read) or obtain sensitive information from process memory via a crafted h264 video file.
The ff_h2645_extract_rbsp function in libavcodec in libav 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read) or obtain sensitive information from process memory via a crafted h264 video file.
OpenStack Glance before Newton has an SSRF vulnerability in the 'copy_from' feature of the Image Service API v1. An attacker can create images with URLs like 'http://localhost:22' to perform masked internal port scans.
ihex.c in GNU Binutils before version 2.26 contains a stack buffer overflow when printing bad bytes in Intel Hex objects.
CVE-2016-4929 in Junos Space before version 15.2R2 contains a vulnerability that allows attackers to execute arbitrary code as a root user.
CVE-2016-4928 is a cross-site request forgery vulnerability in Junos Space before version 15.2R2 that allows remote attackers to perform certain administrative actions.
Insufficient validation of SSH keys in Junos Space before version 15.2R2 allows man-in-the-middle (MITM) type attacks while a Space device is communicating with managed devices.
CVE-2016-4926 describes an insufficient authentication vulnerability in Junos Space before version 15.2R2, allowing remote users with access to the Junos Space web interface to perform certain administrative tasks without authentication.
The code in Apache Tomcat versions from 6.0.0 to 9.0.0.M11 allowed parsing of the HTTP request line with invalid characters. This could be exploited in conjunction with a proxy that also accepted these characters to inject data into the HTTP response.
Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface in the Scheduler in SolarWinds FTP Voyager 16.2.0 allow remote attackers to hijack the authentication of users for requests that change the admin password or terminate the scheduler.
Multiple SQL injection vulnerabilities in Kinsey Infor-Lawson (formerly ESBUS) allow remote attackers to execute arbitrary SQL commands. The attack can be conducted via the TABLE or QUERY parameters.
The vulnerability in saned in sane-backends 1.0.25 allows remote attackers to obtain sensitive memory information via a crafted SANE_NET_CONTROL_OPTION packet.
The IofCallDriver function in USBPcap 1.1.0.0 allows local users to gain privileges via a crafted 0x00090028 IOCTL call, which triggers a NULL pointer dereference.
Buffer overflow in NetRxPkt::ehdr_buf in QEMU when the VLANSTRIP feature is enabled on the vmxnet3 device allows remote attackers to cause a denial of service via out-of-bounds access, leading to a QEMU process crash.
GNU screen before 4.5.1 allows local users to modify arbitrary files and consequently gain root privileges by leveraging improper checking of logfile permissions.