CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The administrative web services interface in Juniper ScreenOS before version 6.3.0r21 allows remote attackers to cause a denial of service (reboot) via a crafted SSL packet.
A race condition in the Op command in Juniper Junos OS allows remote authenticated users to gain privileges via the URL option. This affects versions before 12.1X44-D55, 12.1X46 before 12.1X46-D40, 12.1X47 before 12.1X47-D25, and other listed versions.
An HTTP servlet in vApp Manager in EMC Unisphere for VMAX Virtual Appliance before version 8.2.0 has a vulnerability that allows remote attackers to write to arbitrary files via a crafted pathname.
Heap-based buffer overflow in the unhtmlify function in foomatic-rip in foomatic-filters before version 4.0.6 can be exploited by remote attackers.
A memory leak in Huawei Campus series switches can lead to denial of service. The issue affects specific software versions that cannot properly handle a large number of ICMPv6 packets.
The Data Provisioning Agent (DP Agent) in SAP HANA does not properly restrict access to service functionality, allowing remote attackers to obtain sensitive information, gain privileges, and conduct unspecified other attacks.
The Data Provisioning Agent (DP Agent) in SAP HANA allows remote attackers to cause a denial of service (process crash) via unspecified vectors.
The Enqueue Server in SAP NetWeaver JAVA AS versions 7.1 through 7.4 allows remote attackers to cause a denial of service (process crash) via a crafted request.
The XXE vulnerability in the UDDI component in SAP NetWeaver JAVA AS 7.4 allows remote attackers to cause a system hang by sending a crafted DTD in an XML request to uddi/api/replication.
CVE-2015-8560 describes an incomplete blacklist vulnerability in util.c in foomatic-rip in cups-filters before version 1.4.0 and in foomatic-filters in Foomatic 4.0.x. This allows remote attackers to execute arbitrary commands via a ; (semicolon) character in a print job.
Buffer overflow in hw/pt-msi.c in Xen 4.6.x and earlier, when using the qemu-xen-traditional device model, allows local x86 HVM guest administrators to gain privileges by leveraging a system with access to a passed-through MSI-X capable physical PCI device and MSI-X table entries, related to a 'write path.'
Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (host OS crash) or gain privileges by writing to memory shared between the frontend and backend, known as a double fetch vulnerability.
An integer underflow in the png_check_keyword function in pngwutil.c in libpng allows remote attackers to trigger an out-of-bounds read by using a space character as a keyword in a PNG image.
Multiple SQL injection vulnerabilities in the Administration Web UI servlets in Citrix Command Center before 5.1 Build 36.7 and 5.2 before Build 44.11 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Integer overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before 1.9.3 allows remote authenticated users to cause a denial of service (subversion server crash or memory consumption) and possibly execute arbitrary code via a skel-encoded request body, which triggers an out-of-bounds read and heap-based buffer overflow.
Cisco Unified Computing System (UCS) Central Software 1.3(1b) and earlier allows remote attackers to execute arbitrary OS commands via a crafted HTTP request.
The auth_login.php file in Cacti before version 0.8.8g allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the Cacti database.
The dict.c file in libxml2 contains a vulnerability that allows remote attackers to cause a denial of service through heap-based buffer over-read and application crash. This issue occurs when an unexpected character is encountered immediately after the '<!DOCTYPE html' substring in a crafted HTML document.
Versions of libssh before 0.6.5 have a state validation issue in the handling of SSH_MSG_NEWKEYS and SSH_MSG_KEXDH_REPLY packets, which can lead to system crashes.
Integer overflow in the ImagingResampleHorizontal function in Pillow before version 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, leading to a heap-based buffer overflow.