CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Directory traversal vulnerability in 'jcss.php' in Zikula 1.3.x before 1.3.11 and 1.4.x before 1.4.4 on Windows allows a remote attacker to launch a PHP object injection by uploading a serialized file.
A vulnerability in Siemens SICAM PAS (all versions before V8.09) could allow a remote attacker to cause a Denial of Service condition and potentially lead to unauthenticated remote code execution by sending specially crafted packets to port 19234/TCP.
A vulnerability in Siemens SICAM PAS (all versions before V8.09) allows a remote attacker to upload, download, or delete files in certain parts of the file system by sending specially crafted packets to port 19235/TCP.
OmniVista 8770 versions 2.0 to 3.0 exposes different ORB interfaces that can be queried using the GIOP protocol on TCP port 30024. An attacker can bypass authentication and invoke methods that allow running arbitrary commands on the server with NT AUTHORITY\SYSTEM privileges.
In BMC Patrol before version 9.13.10.02, the binary 'listguests64' is configured with the setuid bit. When executed, it looks for a binary named 'virsh' using the PATH environment variable, allowing it to run 'virsh' with root privileges.
The 'lost password' functionality in b2evolution before 6.7.9 allows remote attackers to reset arbitrary user passwords via a crafted request.
In Serendipity before 2.0.5, an attacker can bypass SSRF protection by using a malformed IP address (e.g., http://127.1) or a 30x (aka Redirection) HTTP status code.
CVE-2016-3055 vulnerability in IBM FileNet Workplace 4.0.2 before version 4.0.2.14 LA012 allows remote authenticated users to read arbitrary files or cause a denial of service (memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference.
IBM AppScan Source versions 8.7 through 9.0.3.3 allows remote authenticated users to read arbitrary files or cause a denial of service (memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
IBM API Connect before version 5.0.3.0 with NPM before version 2.2.8 includes certain internal server credentials in the software package, which might allow remote attackers to bypass intended access restrictions.
A stack-based buffer overflow in the ax Shared Libraries in the Agent in IBM Tivoli Monitoring (ITM) allows local users to gain privileges. This affects versions 6.2.2 before FP9, 6.2.3 before FP5, and 6.3.0 before FP2 on Linux and UNIX.
The notifications component in IBM TRIRIGA Applications 10.4 and 10.5 before 10.5.1 allows remote authenticated users to obtain sensitive password information, potentially leading to privilege escalation.
IBM IMS Enterprise Suite Data Provider before version 3.2.0.1 for Microsoft .NET allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.
CVE-2016-2884 is a CSRF vulnerability in IBM Forms Experience Builder versions 8.5.x and 8.6.x before 8.6.3.1, in an unspecified non-default configuration, allowing remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Multiple cross-site request forgery (CSRF) vulnerabilities in IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 allow remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
IBM QRadar SIEM versions 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 executes unspecified processes at an incorrect privilege level, making it easier for remote authenticated users to obtain root access by leveraging a command-injection issue.
SQL injection vulnerability in IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
IBM QRadar SIEM versions 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 use cleartext storage for unspecified passwords, allowing local users to obtain sensitive information by reading a configuration file.
Buffer overflow in send_redirect() in Boa Webserver 0.92r allows remote attackers to perform a DoS attack via an HTTP GET request with a long URI consisting only of '/' and '.' characters.
CVE-2016-2963 is a CSRF vulnerability in IBM BigFix Remote Control before version 9.1.3 that allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.