CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Huawei Mate8 versions NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 allow attackers to bypass permission checks and control partial module functions via a crafted app.
The image build process for overcloud images in Red Hat OpenStack Platform 8.0 and Red Hat Enterprise Linux OpenStack Platform 7.0 uses a default root password 'ROOTPW', allowing attackers to gain access.
It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. This allowed an attacker to bypass security restrictions and send and receive messages within the cluster.
WordPress versions before 4.5.3 allow remote attackers to bypass the sanitize_file_name protection mechanism via unspecified vectors.
WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie.
WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors.
The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors.
WordPress versions before 4.5.3 allow remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php.
The customizer in WordPress before 4.5.3 allows remote attackers to bypass intended redirection restrictions via unspecified vectors.
Unspecified vulnerability in Opera Mail before 2016-02-16 on Windows allows user-assisted remote attackers to execute arbitrary code via a crafted e-mail message.
Integer overflow in the snd_compr_allocate_buffer function in the ALSA subsystem in the Linux kernel before version 3.6-rc6-next-20120917 may lead to insufficient memory allocation, resulting in denial of service.
The Java Console in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6, when a certain unsupported configuration involving UNC share pathnames is used, allows remote attackers to bypass authentication and possibly execute arbitrary code.
IBM UrbanCode Deploy versions 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 allow remote authenticated users to obtain sensitive cleartext secure-property information via the server UI or a database request.
IBM Spectrum Scale versions 4.1 before 4.1.1.5 and 4.2 before 4.2.0.2, as well as General Parallel File System version 3.5 before 3.5.0.30, allow local users to gain privileges or cause a denial of service via a crafted mmapplypolicy command.
A memory leak in queue-manager agents in IBM WebSphere MQ 8.x before version 8.0.0.5 allows remote attackers to cause a denial of service by triggering many errors.
CA Release Automation versions 5.0.2 before 5.0.2-227, 5.5.1 before 5.5.1-1616, 5.5.2 before 5.5.2-434, and 6.1.0 before 6.1.0-1026 allow remote attackers to read arbitrary files or cause a denial of service via a request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVE-2016-0233 is an SQL injection vulnerability in IBM Marketing Platform 8.5.x, 8.6.x, and 9.x before version 9.1.2.2 that allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
SQL injection vulnerability in IBM Marketing Platform 8.5.x, 8.6.x, and 9.x before 9.1.2.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Multiple heap-based buffer overflows in the hiddev_ioctl_usage function in the Linux kernel through version 4.6.3 may lead to denial of service or other unspecified impacts. The issue occurs with crafted HIDIOCGUSAGES or HIDIOCSUSAGES ioctl calls.
The start_thread function in the Linux kernel up to version 4.6.3 on powerpc platforms mishandles transactional state, potentially leading to denial of service or unspecified other impacts.