CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Bluetooth in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
AppleRAID in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
The Fiddle::Handle implementation in Ruby before version 2.0.0-p648, 2.1 before 2.1.8, and 2.2 before 2.2.4, has a flaw in taint handling, allowing attackers to execute arbitrary code or cause application crashes via a crafted string.
Versions of CA Single Sign-On (SSO) R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, and R12.5 before CR5 have a vulnerability that allows remote attackers to cause a daemon crash or obtain sensitive information via a crafted request.
The Domino web agent in CA Single Sign-On (SSO) before certain versions allows remote attackers to cause a denial of service or obtain sensitive information via a crafted request.
Wielokrotne podatności na wstrzykiwanie CRLF w pliku session.c w sshd w OpenSSH przed wersją 7.2p2 pozwalają zdalnym uwierzytelnionym użytkownikom na obejście zamierzonych ograniczeń dotyczących poleceń powłoki za pomocą spreparowanych danych przekazywania X11, związanych z funkcjami (1) do_authenticated1 i (2) session_x11_req.
HPE Service Manager versions 9.3x before 9.35 P4 and 9.4x before 9.41.P2 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
HPE Operations Orchestration versions 10.x before 10.51 and Operations Orchestration content before 1.7.0 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
HP Support Assistant before 8.1.52.1 allows remote attackers to bypass authentication via unspecified vectors.
The vulnerability in ABB Panel Builder 800 5.1 related to an untrusted search path allows local users to gain privileges via a Trojan horse DLL in the current working directory.
The SysPlant.sys driver in the Application and Device Control (ADC) component in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6-MP4 allows remote attackers to execute arbitrary code via a crafted HTML document, related to 'RWX Permissions.'
CVE-2015-8153 is an SQL injection vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6-MP4 that allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVE-2015-8152 is a CSRF vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6-MP4 that allows remote authenticated users to hijack the authentication of administrators for requests that execute arbitrary code by adding lines to a logging script.
IBM Tivoli NetView Access Services (NVAS) allows remote authenticated users to gain privileges by entering the ADM command and modifying a 'page ID' field to the EMSPG2 transaction code.
HPE System Management Homepage before 7.5.4 allows local users to obtain sensitive information or modify data via unspecified vectors.
HPE System Management Homepage before 7.5.4 allows remote attackers to execute arbitrary code via unspecified vectors.
HPE System Management Homepage before version 7.5.4 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.
The compile_branch function in PCRE 8.x before 8.39 and in PCRE2 before 10.22 mishandles patterns containing the (*ACCEPT) substring in conjunction with nested parentheses. This allows remote attackers to execute arbitrary code or cause a denial of service via a crafted regular expression.
A stack-based buffer overflow in dwrcs.exe in the dwmrcs daemon in SolarWinds DameWare Mini Remote Control 12.0 allows remote attackers to execute arbitrary code via a crafted string.
The bgp_nlri_parse_vpnv4 function in bgpd in Quagga before version 1.0.20160309 is vulnerable to stack-based buffer overflow when a certain VPNv4 configuration is used. Remote attackers can exploit this vulnerability to execute arbitrary code or cause a denial of service.