CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple unspecified vulnerabilities in Google V8 before version 4.8.271.17, as used in Google Chrome before version 48.0.2564.82, may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Multiple unspecified vulnerabilities in Google Chrome before version 48.0.2564.82 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Multiple integer overflows in the sycc422_to_rgb and sycc444_to_rgb functions in PDFium, used in Google Chrome before version 48.0.2564.82, allow remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted PDF document.
Multiple use-after-free vulnerabilities in the formfiller implementation in PDFium, as used in Google Chrome before version 48.0.2564.82, allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document.
The LoadIC::UpdateCaches function in Google V8, used in Google Chrome before version 48.0.2564.82, does not ensure receiver compatibility before performing a cast of an unspecified variable. This allows remote attackers to cause a denial of service or possibly have unknown other impact via crafted JavaScript code.
In eCryptfs-utils, the mount.ecryptfs_private.c script does not validate filesystem types for mount points, allowing local users to gain privileges by mounting over a nonstandard filesystem.
The PV superpage functionality in Xen from versions 3.4.0 to 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impacts via a crafted page identifier (MFN).
wolfSSL versions (formerly CyaSSL) before 3.6.8 are vulnerable to a denial of service attack that can be triggered by a crafted DTLS cookie in a ClientHello message.
An unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown vectors related to Outside In Filters.
Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown vectors related to Outside In Filters.
An unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown vectors related to Outside In Filters.
The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before January 20, 2016, has a hardcoded password for the 1MB@tMaN account. This makes it easier for remote attackers to gain access via an SSH or HTTP session.
CSRF vulnerability in BUFFALO BHR-4GRV2, WEX-300, WHR-1166DHP, WHR-300HP2, WHR-600D, WMR-300, WMR-433, and WSR-1166DHP devices with specific firmware versions allows remote attackers to hijack the authentication of arbitrary users.
The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before 2015-10-12 has a hardcoded password for the BlackWidow account, making it easier for remote attackers to gain access via SSH or HTTP sessions.
A stack-based buffer overflow exists in Hospira Communication Engine (CE) before version 1.2, which can be exploited by remote attackers. Attackers can cause a denial of service or potentially trigger unspecified other impacts via traffic on TCP port 5000.
An unspecified CGI script in Cisco FX-OS before version 1.1.2 on Firepower 9000 devices and in Cisco UCS Manager before versions 2.2(4b), 2.2(5) before 2.2(5a), and 3.0 before 3.0(2e) allows remote attackers to execute arbitrary shell commands via a crafted HTTP request.
Cisco Modular Encoding Platform D9036 software before version 02.04.70 has hardcoded root and guest passwords, making it easier for remote attackers to gain access via an SSH session.
Buffer overflow in the png_set_PLTE function in libpng before version 1.0.65 and in versions 1.1.x, 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause application crashes or possibly have unspecified other impacts via a small bit-depth value in an IHDR (image header) chunk in a PNG image.
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability.
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability.