CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
EMC Data Domain OS versions 5.4 through 5.7 before 5.7.2.0 allows remote authenticated users to bypass intended password-change restrictions. This can be achieved by leveraging access to a different account with the same role as a target account or an account's session at an unattended workstation.
EMC Data Domain OS versions 5.4 through 5.7 before 5.7.2.0 have a default no_root_squash option for NFS exports, making it easier for remote attackers to obtain filesystem access by leveraging client root privileges.
IBM General Parallel File System (GPFS) in versions 2.0.0 through 2.0.7 and 2.5.x through 2.5.5, 3.x before 3.5.5, and 4.x before 4.0.3, allows local users to gain privileges via a crafted parameter to a setuid program.
CVE-2016-1195 describes an open redirect vulnerability in Cybozu Garoon 3.x and 4.x before version 4.2.1 that allows remote attackers to redirect users to arbitrary websites.
The CSRF vulnerability in I-O DATA DEVICE ETX-R devices allows remote attackers to hijack the authentication of arbitrary users.
The printfDx function in Takumi Yamada DX Library for Borland C++ versions 3.13f through 3.16b, Gnu C++ versions 3.13f through 3.16b, and Visual C++ versions 3.13f through 3.16b allows remote attackers to execute arbitrary code via a crafted string.
In H2O before version 1.7.3 and 2.x before 2.0.0-beta5, there is a flaw in handling HTTP/2 disconnection, which can lead to denial of service (use-after-free and application crash) or potentially allow arbitrary code execution via a crafted packet.
Directory traversal vulnerability on BUFFALO WZR-600DHP3 and WZR-S600DHP devices with firmware 2.16 and earlier allows remote attackers to read arbitrary files via unspecified vectors.
Directory traversal vulnerability in kml2jsonp.php in Old_GSI_Maps before January 2015 on Windows allows remote attackers to read arbitrary files via unspecified vectors.
NetCommons version 2.4.2.1 and earlier allows remote authenticated secretariat (aka CLERK) users to gain privileges by creating a SYSTEM_ADMIN account.
HPE Service Manager software versions 9.30 to 9.41 allow remote authenticated users to obtain sensitive information, modify data, and conduct server-side request forgery (SSRF) attacks via unspecified vectors, related to the Server, Web Client, Windows Client, and Service Request components.
The web-based management interface on Cisco RV110W, RV130W, and RV215W devices with outdated firmware allows remote attackers to execute arbitrary code as root via a crafted HTTP request.
The System Configuration Protocol (SCP) core messaging interface in Cisco Prime Network Registrar 8.2 before 8.2.3.1 and 8.3 before 8.3.2 allows remote attackers to obtain sensitive information via crafted SCP messages.
The IPTables firewall in OpenStack Neutron before 7.0.4 and from 8.0.0 to 8.1.0 allows remote attackers to bypass an intended MAC-spoofing protection mechanism, potentially leading to denial of service or interception of network traffic.
The IPTables firewall in OpenStack Neutron before 7.0.4 and from 8.0.0 to 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanism, potentially leading to denial of service or interception of network traffic via a crafted DHCP discovery message.
SolarWinds Virtualization Manager w wersji 6.3.1 i wcześniejszych pozwala lokalnym użytkownikom na uzyskanie podwyższonych uprawnień poprzez wykorzystanie błędnej konfiguracji sudo, co zostało zademonstrowane przez polecenie 'sudo cat /etc/passwd'.
The RMI service in SolarWinds Virtualization Manager 6.3.1 and earlier allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
The IPTables firewall in OpenStack Neutron before 7.0.4 and from 8.0.0 to 8.1.0 allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism, potentially leading to denial of service or interception of network traffic via a link-local source address.
The XML parser in Expat does not use sufficient entropy for hash initialization, allowing context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document.
The mov_read_dref function in libavformat/mov.c in Libav before 11.7 and FFmpeg before 0.11 allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via the entries value in a dref box in an MP4 file.