CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 maintains session ID validity after a logout action, allowing remote authenticated users to hijack sessions by leveraging an unattended workstation.
IBM i Access 7.1 on Windows allows local users to discover registry passwords via unspecified vectors.
Agents in IBM UrbanCode Deploy versions 6.x before 6.0.1.14, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 do not verify a server's identity in a JMS or HTTP session, allowing local users to obtain root access to arbitrary agents via unspecified vectors.
In Samba library versions 4.x before 4.2.14, 4.3.x before 4.3.11, and 4.4.x before 4.4.5, a vulnerability allows man-in-the-middle attackers to bypass a client-signing protection mechanism. This enables spoofing of SMB2 and SMB3 servers.
IBM WebSphere Application Server (WAS) versions 8.5 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 does not set the HTTPOnly flag in the Set-Cookie header for an unspecified JAX-RS API cookie. This makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
The virtual network stack on Cisco AMP Threat Grid Appliance devices before 2.1.1 allows remote attackers to bypass a sandbox protection mechanism, consequently obtaining sensitive interprocess information or modifying interprocess data via a crafted malware sample.
The administrative web interface in Cisco Prime Infrastructure (PI) before 3.1.1 allows remote authenticated users to execute arbitrary commands via crafted field values.
Apache HTTP Server versions 2.4.18 to 2.4.20, when mod_http2 and mod_ssl are enabled, improperly recognize the 'SSLVerifyClient require' directive for HTTP/2 request authorization. This allows remote attackers to bypass intended access restrictions.
The web-restore interface in Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar through 7.1.2 and 7.2.x through 7.2.1 allows remote authenticated users to read or delete directories via a Linux backup-restore operation.
The vulnerability in ntpd in NTP before version 4.2.8p8 allows remote attackers to cause a daemon crash by sending a crypto-NAK packet. This issue exists due to an incorrect fix for CVE-2016-1547.
The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service by modifying the peer variable through spoofed packets from many source IP addresses in a certain scenario.
NTP in versions 4.x before 4.2.8p8 is vulnerable to an attack that can lead to denial of service. A remote attacker can send a spoofed crypto-NAK packet with incorrect authentication data, resulting in the demobilization of ephemeral associations.
The REST plugin in Apache Struts 2 versions 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.
Apache Struts 2 versions 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.
Apache Struts 2 versions 2.3.20 through 2.3.28.1 allow remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.
Apache Struts 2 versions 2.3.20 through 2.3.28.1 mishandle token validation, allowing remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.
The ActionServlet.java in Apache Struts 1 versions 1.1.x through 1.3.10 has improper restriction of the Validator configuration, allowing remote attackers to conduct cross-site scripting (XSS) attacks or cause denial of service via crafted input.
The ActionServlet.java in Apache Struts 1 versions 1.1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, allowing remote attackers to execute arbitrary code or cause a denial of service via unexpected memory access.
The MultiPageValidator implementation in Apache Struts 1 versions 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.