CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
HPE Asset Manager versions 9.40, 9.41, and 9.50 and Asset Manager CloudSystem Chargeback version 9.40 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
The server in IBM Tivoli Storage Manager FastBack in versions 5.5.x and 6.x before 6.1.12.2 allows remote attackers to cause a denial of service (service crash) via crafted packets to a TCP port.
Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command.
Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command.
Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command.
Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command.
Patterson Dental Eaglesoft 17 has a hardcoded password of 'sql' for the dba account, allowing remote attackers to obtain sensitive Dental.DB patient information via SQL statements.
Directory traversal vulnerability in ICONICS WebHMI 9 and earlier allows remote attackers to read configuration files, potentially leading to the disclosure of password hashes.
In WildFly (formerly JBoss Application Server) before version 10.0.0.Final, there is a vulnerability in the servlet filter restriction mechanism that allows remote attackers to read sensitive files in the WEB-INF or META-INF directories.
The CSRF vulnerability on NEC Aterm WF800HP devices with firmware 1.0.17 and earlier allows remote attackers to hijack the authentication of arbitrary users.
CSRF vulnerability in NEC Aterm WG300HP devices allows remote attackers to hijack the authentication of arbitrary users.
Cisco FireSIGHT System Software versions 5.4.0 through 6.0.1 and ASA with FirePOWER Services versions 5.4.0 through 6.0.0.1 allow remote attackers to bypass malware protection via crafted fields in HTTP headers.
The phar_parse_zipfile function in the PHAR extension in PHP before versions 5.5.33 and 5.6.19 allows remote attackers to read sensitive information from process memory or cause a denial of service (DoS) via an out-of-bounds read and application crash when a PK\x05\x06 signature is placed at an invalid location.
A use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service (memory corruption and application crash) by triggering a wddx_deserialize call on XML data containing a crafted var element.
A stack-based buffer overflow in the isofs_real_readdir function in isofs.c in FuseISO 20070708 can be exploited by remote attackers. They can cause application crashes or potentially execute arbitrary code by sending a long pathname in an ISO file.
Integer overflow in the isofs_real_read_zf function in isofs.c in FuseISO 20070708 might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a large ZF block size in an ISO file, leading to a heap-based buffer overflow.
Cogent DataHub before 7.3.10 allows local users to gain privileges by leveraging the user or guest role to modify a file.
Multiple unspecified vulnerabilities in Google V8 before version 4.9.385.33, as used in Google Chrome before version 49.0.2623.108, may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
The PageCaptureSaveAsMHTMLFunction::ReturnFailure function in Google Chrome before version 49.0.2623.108 allows attackers to cause a denial of service or possibly have unspecified other impact by triggering an error in creating an MHTML document.
The Program::getUniformInternal function in Program.cpp in libANGLE, as used in Google Chrome before version 49.0.2623.108, does not properly handle a certain data-type mismatch, which may lead to denial of service (buffer overflow) or other unspecified impacts via crafted shader stages.