CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
HPE Performance Center before version 12.50 and LoadRunner before version 12.50 allow remote attackers to cause a denial of service via unspecified vectors.
HPE Performance Center versions 11.52, 12.00, 12.01, 12.20, and 12.50 allow remote attackers to bypass intended access restrictions via unspecified vectors, related to a 'remote user validation failure' issue.
Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before version 7.3.0-233 allow local users to obtain root access via a crafted parameter to a command that is available in the sudo configuration.
The SMB service in EMC VNXe (including VNXe3200 prior to version 3.1.5.8711957 and VNXe3100/3150/3300 prior to version 2.4.4.22638) and VNX1 and VNX2 File OE before specified versions does not prevent duplicate NTLM challenge-response nonces, making it easier for remote attackers to execute arbitrary code or read/write files.
Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before version 7.3.0-233 use the same encryption key across different customers' installations, allowing remote attackers to defeat cryptographic protection mechanisms.
Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before version 7.3.0-233 rely on client-side authentication, allowing remote attackers to spoof clients and read backup data via a modified client agent.
TLS protocol 1.2 and earlier versions support ClientCertificateType values that may allow man-in-the-middle attackers to spoof TLS servers. This issue arises from the lack of documentation regarding the computation of the master secret in certain situations, making it easier to exploit a compromised X.509 client key.
Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path.
Oracle MySQL versions up to 5.5.52, 5.6.x up to 5.6.33, and 5.7.x up to 5.7.15, as well as MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17, and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7, allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file in the my.cnf file.
Multiple integer overflows in the get_time_t_max and get_time_t_min functions in archive_read_support_format_mtree.c in libarchive before version 3.2.0 may allow remote attackers to trigger unspecified behavior via a crafted mtree file.
bsdtar in libarchive before version 3.2.0 allows remote attackers to cause a denial of service (infinite loop) via an ISO with a directory that is a member of itself.
The ae_strtofflags function in archive_entry.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file.
The lha_read_file_extended_header function in libarchive before version 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds heap) via a crafted lzh or lha file.
The archive_string_append function in libarchive before version 3.2.0 allows remote attackers to cause a denial of service (crash) via crafted cab files, related to 'overlapping memcpy'.
bsdtar in libarchive before version 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an invalid character in the name of a cab file.
AVer Information EH6108H+ devices with firmware X9.03.24.00.07l store passwords in a cleartext base64 format and require cleartext credentials in HTTP Cookie headers, allowing context-dependent attacks to obtain sensitive information.
CVE-2016-6536 affects AVer Information EH6108H+ devices with firmware X9.03.24.00.07l, where remote attackers can bypass intended page-access restrictions or modify passwords by leveraging knowledge of a handle parameter value.
AVer Information EH6108H+ devices with firmware X9.03.24.00.07l have hardcoded accounts, allowing remote attackers to gain root access by leveraging knowledge of the credentials and establishing a TELNET session.
Implementacja IKEv1 w systemie Cisco IOS w wersjach od 12.2 do 12.4 oraz od 15.0 do 15.6, IOS XE do 3.18S, IOS XR 4.3.x i 5.0.x do 5.2.x oraz PIX przed 7.0 pozwala zdalnym atakującym na uzyskanie wrażliwych informacji z pamięci urządzenia poprzez żądanie negocjacji Security Association (SA).
Buffer overflow in Rockwell Automation RSLogix Micro Starter Lite, RSLogix Micro Developer, RSLogix 500 Starter Edition, RSLogix 500 Standard Edition, and RSLogix 500 Professional Edition allows remote attackers to execute arbitrary code via a crafted RSS project file.