CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Yokogawa STARDOM FCN/FCJ controller versions R1.01 through R4.01 do not require authentication for Logic Designer connections, allowing remote attackers to reconfigure the device or cause a denial of service.
ABB DataManagerPro 1.x before 1.7.1 allows local users to gain privileges by replacing a DLL file in the package directory.
Cisco WebEx Meetings Server version 2.6 allows remote attackers to cause a denial of service (CPU consumption) by repeatedly accessing the account-validation component of an unspecified service.
UCS Manager and UCS 6200 Fabric Interconnects in Cisco Unified Computing System (UCS) through 3.0(2d) allow local users to obtain OS root access via crafted CLI input.
otool in Apple Xcode before version 8 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors.
otool in Apple Xcode before version 8 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors.
Cross-site scripting (XSS) vulnerability in EMC ViPR SRM before version 3.7.2 allows remote authenticated users to inject arbitrary web scripts or HTML via unspecified vectors.
Cloud Foundry PHP Buildpack before version 4.3.18 and PHP Buildpack Cf-release before version 242 place the .profile file in the htdocs directory, which might allow remote attackers to obtain sensitive information via an HTTP GET request for this file.
Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.19 and 1.7.x before 1.7.10 has a default password for compilation VMs, allowing remote attackers to gain SSH access.
The metrics-collection component in RabbitMQ for Pivotal Cloud Foundry (PCF) 1.6.x before 1.6.4 logs command lines of failed commands, which might allow attackers to obtain sensitive information by reading the log data.
Multiple open redirect vulnerabilities in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.30 and 1.7.x before 1.7.8 allow remote attackers to redirect users to arbitrary web sites.
The client in EMC RSA BSAFE Micro Edition Suite (MES) versions 4.0.x before 4.0.9 and 4.1.x before 4.1.5 places the weakest algorithms first in a signature-algorithm list, making it easier for remote attackers to defeat cryptographic protection mechanisms.
EMC ViPR SRM versions before 3.7.2 do not restrict the number of password-authentication attempts, making it easier for remote attackers to gain access via a brute-force guessing attack.
Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.17 and 1.7.x before 1.7.8, when using vCloud or vSphere, does not properly enable SSH access for operators, which may lead to unspecified impacts.
Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.34 and 1.7.x before 1.7.12 places the 169.254.0.0/16 address in the all_open Application Security Group, which might allow remote attackers to bypass intended network-connectivity restrictions.
Pivotal Cloud Foundry (PCF) Ops Manager before version 1.5.14 and 1.6.x before version 1.6.9 uses the same cookie-encryption key across different customers' installations, allowing remote attackers to bypass session authentication.
The php_wddx_push_element function in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial of service (invalid pointer access and out-of-bounds read) via an incorrect boolean element in a wddxPacket XML document, leading to mishandling in a wddx_deserialize call.
In PHP before 5.6.26 and 7.x before 7.0.11, there is a vulnerability in ext/spl/spl_array.c that allows SplArray unserialization without validating a return value and data type. This can lead to denial of service or possibly unspecified other impacts via crafted serialized data.
In PHP before 5.6.26 and 7.x before 7.0.11, there is a vulnerability in ext/intl/msgformat/msgformat_format.c that does not properly restrict the locale length provided to the Locale class in the ICU library. This can lead to application crashes or other unspecified impacts.
A stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through version 57.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string.