CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from kernel heap memory by leveraging in-container root access to provide a crafted offset value.
A vulnerability in the setsockopt implementation in the netfilter subsystem of the Linux kernel before version 4.6.3 allows local users to gain privileges or cause a denial of service by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement.
The usbip_recv_xbuff function in the Linux kernel before version 4.5.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted length value in a USB/IP packet.
CVE-2016-2863 describes a CSRF vulnerability in IBM WebSphere Commerce that allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences. It affects version 7.0 Feature Pack 8, 8.0.0.x before 8.0.0.10, and 8.0.1.x before 8.0.1.2.
Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows remote attackers to execute arbitrary code via crafted MPLS packets.
Multiple unspecified vulnerabilities in Google Chrome before version 51.0.2704.103 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Cisco EPC3928 devices allow remote attackers to obtain sensitive configuration and credential information by making requests during the early part of the boot process, related to a 'Boot Information Disclosure' issue.
CVE-2016-1336 affects Cisco EPC3928 devices, where remote attackers can cause a device crash by sending a long LanguageSelect parameter. This issue is related to a 'Gateway HTTP Corruption Denial of Service' problem.
CVE-2016-1328 affects Cisco EPC3928 devices, where remote attackers can cause a device crash by sending an overly long h_sortWireless parameter in a goform/WClientMACList request.
A stack-based buffer overflow in ELCSimulator in Eaton ELCSoft 2.4.01 and earlier allows remote attackers to execute arbitrary code via a long packet.
The NTP time-server interface on Meinberg IMS-LANTIME and LANTIME devices with firmware before version 6.20.004 allows remote authenticated users to obtain root privileges for writing to unspecified scripts. This can lead to obtaining sensitive information or modifying data.
Multiple stack-based buffer overflows in the NTP time-server interface on Meinberg IMS-LANTIME and LANTIME devices, as well as SyncFire 1100 and LCES with firmware before version 6.20.004, allow remote attackers to obtain sensitive information, modify data, or cause a denial of service via a crafted parameter in a POST request.
A stack-based buffer overflow exists in the NTP time-server interface on Meinberg devices that can be exploited by remote attackers. Firmware versions prior to 6.20.004 are vulnerable to attacks that may lead to sensitive information disclosure, data modification, or denial of service.
A cross-site request forgery (CSRF) vulnerability exists in NTT EAST Hikari Denwa and NTT WEST Hikari Denwa routers. This affects routers with firmware PR-400MI, RT-400MI, and RV-440MI versions 07.00.1006 and earlier for NTT EAST and 07.00.1005 and earlier for NTT WEST, allowing remote attackers to hijack the authentication of arbitrary users.
NTT EAST Hikari Denwa routers with firmware PR-400MI, RT-400MI, and RV-440MI version 07.00.1006 and earlier, and NTT WEST Hikari Denwa routers with firmware PR-400MI, RT-400MI, and RV-440MI version 07.00.1005 and earlier allow remote authenticated users to execute arbitrary OS commands via unspecified vectors.
The Transformation implementation in phpMyAdmin versions 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Security Policy (CSP) protection mechanism, making it easier for remote attackers to conduct CSRF attacks by reading an authentication token in a Referer header.
phpMyAdmin versions 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 do not properly choose delimiters, which may allow remote attackers to execute arbitrary PHP code via a crafted string.
In phpMyAdmin versions 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3, a vulnerability allows remote attackers to cause a denial of service via a large array in the scripts parameter.
In phpMyAdmin versions 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3, there is an SQL injection vulnerability in libraries/central_columns.lib.php. Remote attackers can execute arbitrary SQL commands via a crafted database name that is mishandled in a central column query.
A stack-based buffer overflow in the PlayMacro function in ObjectXMacro.ObjectXMacro in WdMacCtl.ocx in Micro Focus Rumba 9.x before 9.3 HF 11997 and 9.4.x before 9.4 HF 12815 allows remote attackers to execute arbitrary code via a long MacroName argument.