CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An issue was discovered in Veritas NetBackup Before 8.0 and NetBackup Appliance Before 3.0 related to the use of hardcoded username and password in the NetBackup Cloud Storage Service.
An issue was discovered in Veritas NetBackup before version 8.0 and NetBackup Appliance before version 3.0 that allows local arbitrary command execution. The use of bpcd and bpnbat can lead to such an attack.
An issue was discovered in Veritas NetBackup before version 7.7.2 and NetBackup Appliance before version 2.7.2, allowing privileged command execution on the NetBackup Server and Client on the local system.
An issue was discovered in Veritas NetBackup Before 7.7.2 and NetBackup Appliance Before 2.7.2 that allows privileged remote command execution on NetBackup Server and Client.
A memory leak in the login_user function in saslserv/main.c in Atheme 7.2.7 allows a remote unauthenticated attacker to consume memory and cause a denial of service. This issue is fixed in version 7.2.8.
The 'OpenID Connect Relying Party and OAuth 2.0 Resource Server' (mod_auth_openidc) module before version 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an 'OIDCUnAuthAction pass' configuration, allowing remote attackers to bypass authentication via crafted HTTP traffic.
An issue exists in PHP 5.x and 7.x related to OpCache that may lead to unauthorized access to compiled script code. This issue occurs in configurations using apache2handler/mod_php or php-fpm with OpCache enabled.
The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2 version 1.2.1 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted DEX file.
Log files generated by Lenovo XClarity Administrator (LXCA) versions earlier than 1.2.2 may contain user credentials in a non-secure, clear text form that could be viewed by a non-privileged user.
A vulnerability in the SCTP decoder of Cisco NetFlow Generation Appliance (NGA) devices with software before 1.1(1a) could allow an unauthenticated, remote attacker to cause the device to hang or unexpectedly reload, leading to a denial of service (DoS) condition. The issue is due to incomplete validation of SCTP packets being monitored on NGA data ports.
IBM Kenexa LCMS Premier versions 9.0 and 10.0.0 are vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, allowing them to view, add, modify, or delete information in the back-end database.
IBM Kenexa LCMS Premier versions 9.0 and 10.0.0 are vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, allowing them to view, add, modify, or delete information in the back-end database.
IBM Kenexa LCMS Premier versions 9.0 and 10.0.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, allowing them to view, add, modify, or delete information in the back-end database.
IBM QRadar 7.2 stores the encryption key used to encrypt the service account password, which can be obtained by a local user.
IBM QRadar 7.2 uses outdated hashing algorithms to hash certain passwords, which could allow a local user to obtain and decrypt user credentials.
The ip_cmsg_recv_checksum function in the Linux kernel before version 4.10.1 has incorrect expectations about skb data layout, allowing local users to cause a denial of service (buffer over-read) or potentially have unspecified other impact via crafted system calls.
A race condition in the Linux kernel before version 4.9.13 in net/packet/af_packet.c allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a multithreaded application making PACKET_FANOUT setsockopt system calls.
The LLC subsystem in the Linux kernel before version 4.9.13 does not ensure that a certain destructor exists in required circumstances, allowing local users to cause a denial of service (BUG_ON) or possibly have unspecified other impact via crafted system calls.
The NetApp ONTAP Select Deploy administration utility versions 2.0 through 2.2.1 may allow remote attackers to obtain sensitive information via unspecified vectors.
The __construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value.