CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Intelligent Baseboard Management Controller (iBMC) in Huawei RH1288 V3, RH2288 V3, RH2288H V3, RH5885 V3, and XH620, XH622, and XH628 servers with software before V100R003C00SPC610 may allow remote attackers to decrypt encrypted data, leading to the exposure of sensitive information.
The RESOLV::lookup iRule command in F5 BIG-IP LTM, APM, ASM, and Link Controller in versions 10.2.1 through 10.2.4, 11.2.1, 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1, and 12.0.0 before HF3 is vulnerable to an attack that can lead to denial of service via a crafted PTR response from remote DNS servers.
Huawei X6800, XH620 V3, RH1288 V3, RH2288 V3, CH140 V3, CH226 V3, CH220 V3, CH121 V3, and CH222 V3 servers with software before V100R003C00SPC606 (and others listed) may allow remote attackers to decrypt encrypted data, leading to the exposure of sensitive information.
Huawei XH620 V3, XH622 V3, XH628 V3, RH1288 V3, RH2288 V3, and RH2288H V3 servers with software before V100R003C00SPC610, V100R003C00SPC613, V100R003C00SPC617, and V100R003C00SPC515 are vulnerable to brute-force attacks, allowing remote attackers to obtain passwords due to a lack of authentication protection mechanisms.
A stack-based buffer overflow in the FascistGecosUser function in the cracklib library allows local users to cause a denial of service (application crash) or gain privileges via a long GECOS field.
Ruby on Rails 4.2.x versions before 4.2.7.1 improperly handle parameter differences between the Active Record component and the JSON implementation, allowing remote attackers to bypass intended database-query restrictions.
The Camera driver in Huawei Honor 4C smartphones with software before version CHM-UL00C00B564, CHM-TL00C01 before CHM-TL00C01B564, and CHM-TL00C00 before CHM-TL00HC00B564 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application.
The Camera driver in Huawei Honor 4C smartphones with software before versions CHM-UL00C00B564, CHM-TL00C01B564, and CHM-TL00HC00B564 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application.
The Camera driver in Huawei Honor 4C smartphones with software before versions CHM-UL00C00B564, CHM-TL00C01B564, and CHM-TL00HC00B564 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application.
The Camera driver in Huawei Honor 4C smartphones with specific software versions allows attackers to cause a system crash or gain privileges via a crafted application.
The Camera driver in Huawei Honor 4C smartphones with software before versions CHM-UL00C00B564, CHM-TL00C01B564, and CHM-TL00HC00B564 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application.
The web console in Red Hat JBoss Operations Network (JON) before version 3.3.7 does not properly authorize requests to add users with the super user role, allowing remote authenticated users to gain admin privileges via a crafted POST request.
A vulnerability in F5 BIG-IP that affects various software versions allows remote attackers to cause a denial of service by restarting the traffic management microkernel when packet filtering is enabled on virtual servers.
The dashbuilder in Red Hat JBoss BPM Suite 6.3.2 does not properly handle CSRF tokens generated during an active session, allowing remote attackers to bypass CSRF protection mechanisms or conduct CSRF attacks by obtaining an old token.
Eye of GNOME (eog) versions 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib before 2.44.1, allow remote attackers to cause a denial of service via invalid UTF-8 passed to GMarkup.
RESTEasy enables GZIPInterceptor, allowing remote attackers to cause a denial of service via unspecified vectors.
A vulnerability has been identified in the EN100 Ethernet module affecting various firmware variants. Attackers with access to the device's web interface may bypass authentication and perform certain administrative operations.
A vulnerability has been identified in the EN100 Ethernet module affecting various firmware variants. Versions below specified numbers may be susceptible to an attack that causes the device to enter defect mode upon receiving specially crafted packets on port 80/tcp.
A vulnerability has been identified in the EN100 Ethernet module for various firmware variants that are older than specified versions. Attackers with access to the device's web interface may bypass authentication and perform certain administrative operations.
Media Origination System Suite Software 2.6 and earlier in Cisco Virtual Media Packager (VMP) allows remote attackers to bypass authentication and make arbitrary Platform and Applications Manager (PAM) API calls via unspecified vectors.