CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2016-2082 is a CSRF vulnerability in VMware vRealize Log Insight versions 2.x and 3.x before 3.3.2, allowing remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Multiple stack-based buffer overflows in COM objects in Micro Focus Rumba 9.4.x before 9.4 HF 13960 allow remote attackers to execute arbitrary code. The attack can be carried out through various properties and arguments in specific DLLs.
Cisco Cloud Network Automation Provisioner (CNAP) version 1.0(0) in Cisco Configuration Assistant (CCA) allows remote attackers to bypass intended filesystem and administrative-endpoint restrictions via GET API calls.
Cisco Firepower System Software versions 6.0.0 through 6.1.0 has a hardcoded account that allows remote attackers to gain CLI access if they know the password.
Apple AirPort Base Station firmware before 7.6.7 and 7.7.x before 7.7.7 misparses DNS data, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
A vulnerability in Flexera InstallAnywhere related to an untrusted search path allows local users to gain privileges via a malicious DLL in the current working directory of a setup-launcher executable file.
IBM InfoSphere Streams before 4.0.1.2 and IBM Streams before 4.1.1.1 do not properly implement the runAsUser feature, allowing local users to obtain root group privileges via unspecified vectors.
Cisco Prime Collaboration Provisioning 10.6 SP2 mishandles LDAP authentication, allowing remote attackers to obtain administrator privileges via a crafted login attempt.
Cisco Prime Infrastructure versions 1.2 through 3.1 and Evolved Programmable Network Manager versions 1.2 and 2.0 allow remote authenticated users to execute arbitrary commands or upload files via a crafted HTTP request.
The API in Cisco Prime Infrastructure versions 1.2 through 3.0 and Evolved Programmable Network Manager (EPNM) 1.2 allows remote attackers to execute arbitrary code or obtain sensitive management information via a crafted HTTP request.
The IBM Watson Developer Cloud services on Bluemix platforms do not properly generate random numbers for service-instance credentials, making it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.
CVE-2016-0386 describes a CSRF vulnerability in IBM TRIRIGA Application Platform that allows remote authenticated users to hijack the authentication of administrators for requests that delete employees. It affects versions before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2.
JMS Client in IBM MessageSight versions 1.1.x through 1.1.0.1, 1.2.x through 1.2.0.3, and 2.0.x through 2.0.0.0 allows remote authenticated users to obtain administrator privileges for executing arbitrary commands via unspecified vectors.
The builder tools in IBM TRIRIGA Application Platform versions 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allow remote authenticated users to gain privileges for application modification via unspecified vectors.
IBM TRIRIGA Application Platform versions 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allow remote authenticated users to conduct server-side request forgery (SSRF) attacks. Attackers can trigger network traffic to arbitrary intranet or Internet hosts via a crafted proxy request to a web service.
Multiple cross-site request forgery (CSRF) vulnerabilities in management scripts in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allow remote authenticated users to hijack the authentication of arbitrary users.
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to discover the PHP JSESSIONID value via unspecified vectors.
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to discover credentials via a brute-force attack.
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to bypass the Authentication Lock protection mechanism. This enables brute-force password-guessing attacks against management-console accounts.
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, enabling them to trigger network traffic to arbitrary intranet hosts via a crafted request.