CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in the Wi-Fi driver in Huawei P8 smartphones with software before GRA-CL00C92B363 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application.
Buffer overflow in the Wi-Fi driver in Huawei P8 smartphones with software before GRA-CL00C92B363 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application.
Huawei NE40E, CX600, PTN 6900-2-M8, NE5000E, and CloudEngine 12800 devices with specific software versions are vulnerable to remote attacks. Attackers with control plane access can cause denial of service or execute arbitrary code via crafted packets.
Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, allowing remote attackers to execute arbitrary code via vectors related to XStream Serialization.
Pulse Secure Desktop before version 5.2R2 and Pulse Secure Installer Service before version 8.2R2 for Windows allow restricted users to gain privileges via unspecified vectors.
Palo Alto Networks PAN-OS versions before 5.0.19, 5.1.x before 5.1.12, 6.0.x before 6.0.14, 6.1.x before 6.1.12, and 7.0.x before 7.0.8 may allow local users to gain privileges by leveraging improper sanitization of the root_reboot local invocation.
The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which might allow local users to execute arbitrary code via a Trojan horse library under the current working directory.
The server in Red Hat JBoss Operations Network (JON) before version 3.3.6 allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization.
Perl versions 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 improperly remove '.' characters from the end of the includes directory array. This may allow local users to gain privileges via a Trojan horse module under the current working directory.
Intel Crosswalk versions before 19.49.514.5, 20.x before 20.50.533.11, 21.x before 21.51.546.0, and 22.x before 22.51.549.0 interpret a user's acceptance of one invalid X.509 certificate as acceptance of all invalid X.509 certificates without prompting. This makes it easier for man-in-the-middle attackers to spoof SSL servers and obtain sensitive information via a crafted certificate.
Integer overflow in the kbasep_vinstr_attach_client function in Google Chrome before version 52.0.2743.85 allows remote attackers to cause a denial of service by leveraging unrestricted multiplication.
SQL injection vulnerability in the Seed Coupon plugin before version 1.6 for EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
In Vtiger CRM version 6.4.0 and earlier, there is a vulnerability in Save.php that does not properly restrict user-save actions. This allows remote authenticated users to create or modify user accounts.
The AdminUI in HPE Operations Manager (OM) before version 9.21.130 on Linux, Unix, and Solaris allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
The TS_OBJ_print_bio function in OpenSSL up to version 1.0.2h contains a vulnerability that allows remote attackers to cause application crashes via a crafted time-stamp file. This issue occurs when processing the file with the 'openssl ts' command.
Novell Filr version 1.2 before Hot Patch 6 and 2.0 before Hot Patch 2 has world-writable permissions for the /etc/profile.d/vainit.sh file, allowing local users to gain elevated privileges by replacing this file's content with arbitrary shell commands.
Directory traversal vulnerability in the email-template feature in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote attackers to bypass intended access restrictions and write to arbitrary files via a .. (dot dot) in a blob name.
In Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2, remote authenticated users can execute arbitrary commands via shell metacharacters in the ntpServer parameter.
Multiple CSRF vulnerabilities in the administrative interface in Novell Filr before 2.0 Security Update 2 allow remote attackers to hijack the authentication of administrators, as demonstrated by reconfiguring time settings via a vaconfig/time request.
A vulnerability in Cisco AsyncOS on Email Security Appliance (ESA) devices allows remote attackers to bypass malware detection via a crafted attachment in an email message.