CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2015-0570 involves a stack-based buffer overflow in the SET_WPS_IE IOCTL implementation in wlan_hdd_hostapd.c in the WLAN driver for Linux kernel 3.x and 4.x. This allows attackers to gain privileges via a crafted application that uses a long WPS IE element.
CVE-2015-0569 involves a heap-based buffer overflow in the WLAN driver for Linux kernel 3.x and 4.x, allowing attackers to gain privileges via a crafted application that establishes a packet filter.
The Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows local users to add an SSH key to an arbitrary group, potentially leading to unauthorized privilege escalation.
The Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows remote authenticated users to execute arbitrary commands by leveraging the YUM_CLIENT restricted-user role.
CVE-2016-2351 describes an SQL injection vulnerability in the home/seos/courier/security_key2.api file on the Accellion File Transfer Appliance (FTA) before version FTA_9_12_40. This allows remote attackers to execute arbitrary SQL commands via the client_id parameter.
The management-services protocol implementation in Veritas NetBackup versions 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7.7.2, as well as in NetBackup Appliance versions 2.5.4, 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, and 2.7.x before 2.7.2 allows remote attackers to make arbitrary RPC calls via unspecified vectors.
The bpcd in Veritas NetBackup versions 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7.7.2, as well as in NetBackup Appliance versions 2.5.4, 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, and 2.7.x before 2.7.2, allows remote attackers to execute arbitrary commands via crafted input.
HPE Network Node Manager i (NNMi) versions 9.20, 9.23, 9.24, 9.25, 10.00, and 10.01 allow remote authenticated users to modify data or cause a denial of service via unspecified vectors.
HPE Network Node Manager i (NNMi) versions 9.20, 9.23, 9.24, 9.25, 10.00, and 10.01 allows remote authenticated users to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
A heap-based buffer overflow in the zip_read_mac_metadata function in archive_read_support_format_zip.c in libarchive before version 3.2.0 allows remote attackers to execute arbitrary code via crafted entry-size values in a ZIP archive.
A double free vulnerability in the DefaultICCintents function in cmscnvrt.c in liblcms2 in Little CMS 2.x before 2.6 allows remote attackers to execute arbitrary code via a malformed ICC profile that triggers an error in the default intent handler.
The pam_sm_authenticate function in pam_sshauth.c in libpam-sshauth might allow context-dependent attackers to bypass authentication or gain privileges via a system user account.
The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service via a crafted JSON file, leading to stack consumption and application crash. This issue has been fixed in jq 1.6_rc1-r0.
The HTTPS NIO Connector allows remote attackers to cause a denial of service (thread consumption) by opening a socket and not sending an SSL handshake, known as a read-timeout vulnerability.
CVE-2015-8868 involves a heap-based buffer overflow in the ExponentialFunction::ExponentialFunction function in Poppler before version 0.40.0. This allows remote attackers to cause a denial of service or potentially execute arbitrary code via an invalid blend mode in the ExtGState dictionary in a crafted PDF document.
Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.
Cool Projects TarDiff allows remote attackers to execute arbitrary commands via shell metacharacters in the name of a (1) tar file or (2) file within a tar file.
The adreno_perfcounter_query_group function in the Adreno GPU driver for Linux kernel 3.x uses an incorrect integer data type, which may lead to denial of service through integer overflow, heap-based buffer overflow, and incorrect memory allocation.
The msm_ipc_router_bind_control_port function in the IPC router kernel module for Linux kernel 3.x does not verify that a port is a client port. This allows attackers to gain privileges or cause a denial of service by making many BIND_CONTROL_PORT ioctl calls.
CVE-2016-1392 is an open redirect vulnerability in Cisco Prime Collaboration Assurance Software versions 10.5 through 11.0 that allows remote attackers to redirect users to arbitrary websites.