CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
EMC Data Domain OS versions 5.5 before 5.5.4.0, 5.6 before 5.6.1.004, and 5.7 before 5.7.2.0 store session identifiers of GUI users in a world-readable file, allowing local users to hijack arbitrary accounts via unspecified vectors.
The up.time agent in Idera Uptime Infrastructure Monitor versions 7.5 and 7.6 on Linux allows remote attackers to read arbitrary files via unspecified vectors.
CVE-2016-4449 describes an XXE vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before version 2.9.4. This vulnerability, when not in validating mode, allows attackers to read arbitrary files or cause denial of service through unspecified vectors.
A format string vulnerability in libxml2 before version 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.
The xmlParseElementDecl function in libxml2 before version 2.9.4 allows context-dependent attackers to cause a denial of service via a crafted file, resulting in heap-based buffer underread and application crash.
SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface parameters, a similar issue to CVE-2015-5261.
The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors related to connecting to a guest VM, which triggers a heap-based buffer overflow.
CVE-2016-4532 describes a vulnerability in the WAP interface of Trihedral VTScada in versions 8.x through 11.x before 11.2.02, allowing remote attackers to read arbitrary files via a crafted pathname.
Interfejs WAP w Trihedral VTScada w wersjach 8.x do 11.x przed 11.2.02 umożliwia zdalnym atakującym spowodowanie odmowy usługi poprzez nieokreślone wektory, co prowadzi do odczytu poza zakresem i awarii aplikacji.
The WAP interface in Trihedral VTScada in versions 8.x through 11.x before 11.2.02 allows remote attackers to bypass authentication and read arbitrary files via unspecified vectors.
HPE Project and Portfolio Management Center (PPM) versions 9.2x and 9.3x before 9.32.0002 allow remote authenticated users to execute arbitrary commands or obtain sensitive information via unspecified vectors.
General Electric (GE) Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware before 5.5.0 and ML810, ML3000, and ML3100 switches with firmware before 5.5.0k have hardcoded credentials, allowing remote attackers to modify configuration settings via the web interface.
Red Hat OpenShift Enterprise 3.2 improperly restricts access to STI builds, allowing remote authenticated users to access the Docker socket and gain privileges via vectors related to build-pod.
Red Hat OpenShift Enterprise 3.2 with multi-tenant SDN enabled allows remote authenticated users to access network resources on restricted pods when a build is run in a namespace that would normally be isolated from other pods. The issue occurs with builder images that contain ONBUILD commands or lack a tar binary.
Red Hat OpenShift Enterprise 3.2 and OpenShift Origin allow remote authenticated users to execute commands with root privileges by changing the root password in an sti builder image.
Buffer overflow in the DecodeAdpcmImaQT function in VideoLAN VLC media player before version 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.
HPE Discovery and Dependency Mapping Inventory (DDMi) versions 9.30, 9.31, 9.32, and updates 1, 2, and 3 allow remote authenticated users to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
HPE Universal CMDB versions 10.0 through 10.21, Universal CMDB Configuration Manager versions 10.0 through 10.21, and Universal Discovery versions 10.0 through 10.21 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
The Universal Discovery component in HPE Universal CMDB versions 10.0, 10.01, 10.10, 10.11, 10.20, and 10.21 allows remote attackers to obtain sensitive information via unspecified vectors.
HPE Systems Insight Manager (SIM) before 7.5.1 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unspecified vectors.