CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A double free vulnerability in the dsa_priv_decode function in OpenSSL before version 1.0.1s and 1.0.2 before version 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.
Cisco Nexus 3000 and 3500 devices running NX-OS versions 6.0(2)U6(1) to 6.0(2)U6(5) and 6.0(2)A6(1) to 6.0(2)A6(5) and 6.0(2)A7(1) contain hardcoded credentials. This allows remote attackers to gain root privileges via a TELNET or SSH session.
Podatność typu cross-site scripting (XSS) w serwerze WWW w urządzeniach Rockwell Automation Allen-Bradley CompactLogix 1769-L* przed wersją 28.011+ umożliwia zdalnym atakującym wstrzykiwanie dowolnych skryptów webowych lub HTML za pomocą nieokreślonych wektorów.
The vulnerability in Schneider Electric Struxureware Building Operations Automation Server AS 1.7 and earlier and AS-P 1.7 and earlier allows remote authenticated administrators to execute arbitrary OS commands by defeating an msh (Minimal Shell) protection mechanism.
A stack-based buffer overflow in IBM Tivoli Storage Manager FastBack versions 5.5 and 6.1.x through 6.1.11.1 allows remote attackers to cause a daemon crash.
A stack-based buffer overflow in IBM Tivoli Storage Manager FastBack versions 5.5 and 6.1.x through 6.1.11.1 allows remote attackers to cause a daemon crash.
A stack-based buffer overflow in IBM Tivoli Storage Manager FastBack versions 5.5 and 6.1.x through 6.1.11.1 allows remote attackers to cause a daemon crash.
CVE-2015-7428 in IBM WebSphere Portal 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF09 contains an open redirect vulnerability that allows remote attackers to redirect users to arbitrary websites.
In Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 on Windows, there is an untrusted search path vulnerability in the WiresharkApplication class. This allows local users to gain privileges via a Trojan horse riched20.dll.dll file in the current working directory.
In Squid 4.x before version 4.0.7, there is a vulnerability related to the handling of the HTTP status code after a response-parsing failure. This allows remote HTTP servers to cause a denial of service by sending a malformed response.
In Squid 3.x before version 3.5.15 and 4.x before version 4.0.7, http.cc continues to store data after a response-parsing failure. This allows remote HTTP servers to cause a denial of service by sending a malformed response.
The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not check buffer limits during XML parsing, which can lead to a denial of service.
Squid versions 3.x before 3.5.15 and 4.x before 4.0.7 do not properly append data to String objects, allowing remote servers to cause a denial of service (assertion failure and daemon exit) via a long string, as demonstrated by a crafted HTTP Vary header.
QNAP iArtist Lite before 1.4.54, as distributed with QNAP Signage Station before 2.0.1, allows remote authenticated users to gain privileges by registering an executable file, and then waiting for this file to be run in a privileged context after a reboot.
The FTP service in QNAP iArtist Lite before version 1.4.54, as distributed with QNAP Signage Station before version 2.0.1, has hardcoded credentials, making it easier for remote attackers to gain access via a session on TCP port 21.
QNAP Signage Station before 2.0.1 allows remote attackers to bypass authentication, enabling file uploads via a spoofed HTTP request.
An unrestricted file upload vulnerability in QNAP Signage Station before version 2.0.1 allows remote authenticated users to execute arbitrary code by uploading an executable file and then accessing this file via an unspecified URL.
The Device Manager GUI in Cisco Application Control Engine (ACE) 4710 A5 before A5(3.1) allows remote authenticated users to bypass intended RBAC restrictions and execute arbitrary CLI commands with admin privileges via an unspecified parameter in a POST request.
The session-persistence implementation in Apache Tomcat in versions 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes. This allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.
The Manager and Host Manager applications in Apache Tomcat before versions 7.0.68, 8.0.31, and 9.0.0.M2 have a vulnerability that allows establishing sessions and sending CSRF tokens for arbitrary new requests. This enables remote attackers to bypass the CSRF protection mechanism using a token.