CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, allowing context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.
A stack-based buffer overflow in the glob implementation in GNU C Library (glibc) before version 2.24 can be exploited by context-dependent attackers. This allows them to cause a denial of service (crash) by providing a long name.
Sixnet BT-5xxx and BT-6xxx M2M devices before 3.8.21 and 3.9.x before 3.9.8 have hardcoded credentials, allowing remote attackers to gain access via unspecified vectors.
CSRF vulnerability in Resource Data Management (RDM) Intuitive 650 TDB Controller devices before version 2.1.24 allows remote authenticated users to hijack the authentication of arbitrary users.
Intuitive 650 RDM TDB Controller devices before version 2.1.24 allow remote authenticated users to modify arbitrary passwords via unspecified vectors.
Environmental Systems Corporation (ESC) 8832 Data Controller version 3.02 and earlier allows remote attackers to bypass intended access restrictions and execute arbitrary functions via a modified parameter.
Environmental Systems Corporation (ESC) 8832 Data Controller 3.02 and earlier mishandles sessions, allowing remote attackers to bypass authentication and make arbitrary configuration changes.
Moxa MiiNePort_E1_4641, MiiNePort_E1_7080, MiiNePort_E2_1242, MiiNePort_E2_4561, and MiiNePort E3 devices with specified firmware versions allow remote attackers to obtain sensitive cleartext information by reading a configuration file.
Moxa MiiNePort_E1_4641, MiiNePort_E1_7080, MiiNePort_E2_1242, MiiNePort_E2_4561, and MiiNePort E3 devices with specified firmware versions have a blank default password. This allows remote attackers to gain access via unspecified vectors.
There is a cross-site request forgery (CSRF) vulnerability in Moxa MiiNePort_E1_4641, MiiNePort_E1_7080, MiiNePort_E2_1242, MiiNePort_E2_4561, and MiiNePort E3 devices. This allows remote attackers to hijack the authentication of arbitrary users.
Moxa Secure Router EDR-G903 devices before version 3.4.12 do not delete copies of configuration and log files after completing the import function, allowing remote attackers to obtain sensitive information by requesting these files at an unspecified URL.
Moxa Secure Router EDR-G903 devices before version 3.4.12 are vulnerable to a denial of service (cold start) attack by sending two crafted ping requests.
A memory leak on Moxa Secure Router EDR-G903 devices before version 3.4.12 allows remote attackers to cause a denial of service by executing the ping function.
Moxa Secure Router EDR-G903 devices before version 3.4.12 allow remote attackers to discover cleartext passwords by reading a configuration file.
Moxa Secure Router EDR-G903 devices before version 3.4.12 allow remote attackers to read configuration and log files via a crafted URL.
CVE-2016-4118 describes an untrusted search path vulnerability in the installer of Adobe Connect Add-In before version 11.9.976.291 on Windows, allowing local users to gain privileges via unspecified vectors.
iRZ RUH2 versions before 2b do not validate firmware patches, allowing remote authenticated users to modify data or cause a denial of service via unspecified vectors.
HPE Service Manager versions 9.30 to 9.41 allow remote attackers to obtain sensitive information via unspecified vectors, related to the Web Client, Service Request Catalog, and Mobility components.
The server in HP Release Control versions 9.13, 9.20, and 9.21 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in Cisco IOS XE, IOS XR, and NX-OS allows remote attackers to cause a denial of service via crafted ND messages.