CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In NUUO NVRmini 2, NUUO NVRsolo, NUUO Crystal, and NETGEAR ReadyNAS Surveillance, a vulnerability allows remote attackers to execute arbitrary PHP code via the NTPServer parameter.
__debugging_center_utils___.php in NUUO NVRmini 2 versions 1.7.5 through 3.0.0, NUUO NVRsolo versions 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance versions 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter.
VMware vRealize Automation 7.0.x before 7.1 allows remote attackers to execute arbitrary code via unspecified vectors.
VMware Identity Manager 2.x before 2.7 and vRealize Automation 7.0.x before 7.1 allow local users to obtain root access via unspecified vectors.
VMware Photos OS OVA 1.0 before 2016-08-14 has a default SSH public key in an authorized_keys file, which allows remote attackers to obtain SSH access by leveraging knowledge of the private key.
CVE-2016-6195 is an SQL injection vulnerability in moderation.php in vBulletin before version 4.2.2 Patch Level 5 and 4.2.3 before Patch Level 1. It allows remote attackers to execute arbitrary SQL commands via the postids parameter in request.php.
Buffer overflow in the handle_packet function in mactelnet.c in the client in MAC-Telnet 0.4.3 and earlier allows remote TELNET servers to execute arbitrary code via a long string in an MT_CPTYPE_PASSSALT control packet.
Multiple integer overflows in the MDSS driver for the Linux kernel 3.x, used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to cause a denial of service or possibly have unspecified other impact via a large size value.
A heap-based buffer overflow exists in the wcnss_wlan_write function in the wcnss_wlan device driver for Linux kernel 3.x. Attackers can cause a denial of service or potentially unspecified other impacts by writing to /dev/wcnss_wlan with an unexpected amount of data.
ReadyDesk 9.1 allows local users to obtain cleartext SQL Server credentials by reading the SQL_Config.aspx file and decrypting data with a hardcoded key in the ReadyDesk.dll file.
Accellion Kiteworks appliances before kw2016.03.00 use setuid-root permissions for /opt/bin/cli, allowing local users to gain privileges via unspecified vectors.
ReadyDesk 9.1 has an unrestricted file upload vulnerability in chat/sendfile.aspx that allows remote attackers to execute arbitrary code by uploading and requesting a .aspx file.
Directory traversal vulnerability in chat/openattach.aspx in ReadyDesk 9.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the SESID parameter in conjunction with a filename in the FNAME parameter.
ReadyDesk 9.1 has an SQL injection vulnerability in chat/staff/default.aspx that allows remote attackers to execute arbitrary SQL commands via the user name field.
The components in HPE XP P9000 Command View Advanced Edition Software before version 8.4.1-00 and XP7 Command View Advanced Edition Suite before version 8.4.1-00 have a vulnerability that allows remote attackers to obtain sensitive information via unspecified vectors.
Adobe Reader and Acrobat before version 11.0.17, and Acrobat and Acrobat Reader DC Classic before version 15.006.30198, as well as Acrobat and Acrobat Reader DC Continuous before version 15.017.20050 on Windows and OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Reader and Acrobat before version 11.0.17, and Acrobat and Acrobat Reader DC Classic before version 15.006.30198, as well as Acrobat and Acrobat Reader DC Continuous before version 15.017.20050 on Windows and OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Reader and Acrobat before version 11.0.17, and Acrobat and Acrobat Reader DC Classic before version 15.006.30198, as well as Acrobat and Acrobat Reader DC Continuous before version 15.017.20050 on Windows and OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Reader and Acrobat before version 11.0.17, and Acrobat and Acrobat Reader DC Classic before version 15.006.30198, as well as Acrobat and Acrobat Reader DC Continuous before version 15.017.20050 on Windows and OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Reader and Acrobat before version 11.0.17, and Acrobat and Acrobat Reader DC Classic before version 15.006.30198, as well as Acrobat and Acrobat Reader DC Continuous before version 15.017.20050 on Windows and OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.