CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A race condition in Advantech WebAccess before version 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via a crafted request.
Multiple heap-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors.
Multiple stack-based buffer overflows in Advantech WebAccess before version 8.1 allow remote attackers to execute arbitrary code via unspecified vectors.
Directory traversal vulnerability in Advantech WebAccess before 8.1 allows remote attackers to list arbitrary virtual-directory files via unspecified vectors.
CVE-2016-0854 describes an unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in Advantech WebAccess before version 8.1. This allows remote attackers to write to files of arbitrary types via unspecified vectors.
Advantech WebAccess before 8.1 allows remote attackers to obtain sensitive information via crafted input.
Advantech WebAccess before 8.1 allows remote attackers to bypass an intended administrative requirement and obtain file or folder access via unspecified vectors.
Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service (out-of-bounds memory access) via unspecified vectors.
Web Viewer version 1.0.0.193 on Samsung SRN-1670D devices allows attackers to bypass filesystem encryption via XOR calculations.
Web Viewer version 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to discover credentials by reading detailed error messages.
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an unspecified PHP script.
Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code via vectors involving a browser plugin.
Cisco Aironet 1800 devices with software versions 7.2, 7.3, 7.4, 8.1(112.3), 8.1(112.4), and 8.1(15.14) have a default account, which makes it easier for remote attackers to gain access via unspecified vectors.
The Admin portal in Cisco Identity Services Engine (ISE) versions 1.1.x, 1.2.0 before patch 17, 1.2.1 before patch 8, 1.3 before patch 5, and 1.4 before patch 4 allows remote attackers to obtain administrative access via unspecified vectors.
The IP ingress packet handler on Cisco Aironet 1800 devices with software 8.1(112.3) and 8.1(112.4) allows remote attackers to cause a denial of service via a crafted header in an IP packet.
Cisco Wireless LAN Controller (WLC) devices with software 7.6.x, 8.0 before 8.0.121.0, and 8.1 before 8.1.131.0 allow remote attackers to change configuration settings via unspecified vectors.
The CSRF vulnerability in IBM WebSphere Commerce allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences. It affects versions 6.0 through 6.0.0.11 and 7.0 through 7.0.0.9 and 7.0 Feature Pack 8.
SQL injection vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
The CSRF vulnerability in Advantech WebAccess before version 8.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Funkcje roaming_read i roaming_write w OpenSSH w wersjach 5.x, 6.x i 7.x przed 7.1p2 nie utrzymują prawidłowo deskryptorów plików połączeń, gdy włączone są określone opcje proxy i forward. To może prowadzić do odmowy usługi (przepełnienie bufora na stercie) lub innych nieokreślonych skutków przez żądanie wielu przekierowań.