CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2016-4349 in Cisco WebEx Productivity Tools 2.40.5001.10012 has an untrusted search path vulnerability that allows local users to gain privileges via malicious DLL files in the current working directory.
CVE-2016-1389 in Cisco WebEx Meetings Server (CWMS) 2.6 is an open redirect vulnerability that allows remote attackers to redirect users to arbitrary websites.
The API in Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) 1.0(1) allows remote attackers to spoof administrative notifications via crafted attribute-value pairs.
The arch_pick_mmap_layout function in the Linux kernel up to version 4.5.2 does not properly randomize the legacy base address, making it easier for local users to bypass restrictions on the ADDR_NO_RANDOMIZE flag and the ASLR protection mechanism for setuid or setgid programs.
Integer overflow in the xt_alloc_table_info function in the Linux kernel up to version 4.5.2 on 32-bit platforms allows local users to gain privileges or cause a denial of service via an IPT_SO_SET_REPLACE setsockopt call.
The netfilter subsystem in the Linux kernel through 4.5.2 does not validate certain offset fields, allowing local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call.
The fork implementation in the Linux kernel before version 4.5 on s390 platforms mishandles the case of four page-table levels, allowing local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted application.
A race condition in the Linux kernel before version 4.4.1 in arch/x86/mm/tlb.c allows local users to gain privileges by triggering access to a paging structure by a different CPU.
In the Linux kernel before version 4.5, there is a bug in iwch_cm.c that does not properly identify error conditions. This allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted packets.
Buffer overflow in the mipsnet_receive function in hw/net/mipsnet.c in QEMU, when the guest NIC is configured to accept large packets, allows remote attackers to cause a denial of service (memory corruption and QEMU crash) or possibly execute arbitrary code via a packet larger than 1514 bytes.
In Apache Struts 2.x before version 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1, a vulnerability allows remote attackers to execute arbitrary code via the stylesheet location parameter.
Apache Struts versions 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
Integer signedness error in GD Graphics Library 2.1.1 allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code via crafted compressed gd2 data, triggering a heap-based buffer overflow.
yast2-users before 3.1.47, as used in SUSE Linux Enterprise 12 SP1, does not properly set empty password fields in /etc/shadow during an AutoYaST installation when the profile does not contain inst-sys users.
Allround Automations PL/SQL Developer 11 before version 11.0.6 relies on unverified HTTP data for updates, allowing man-in-the-middle attackers to execute arbitrary code by modifying fields in the client-server data stream.
SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before version 01A.8 use the same hardcoded encryption key across different customers' installations, allowing attackers to defeat cryptographic protection mechanisms.
The web interface on SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before version 01A.8 has a vulnerability in the flu.cgi file that allows remote authenticated users to execute arbitrary commands via the 5066 (dnsmasq) parameter.
The web interface on SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before 01A.8 has a default password, which makes it easier for remote attackers to obtain access via unspecified vectors.
CVE-2016-1202 in Atom Electron before version 0.33.5 has an untrusted search path vulnerability that allows local users to gain privileges via a Trojan horse Node.js module in a parent directory.
A buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses.