CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2015-7917 describes an untrusted search path vulnerability in Open Automation OPC Systems version 8.00.0023 and earlier, allowing local users to gain privileges via a Trojan horse DLL in an unspecified directory.
Saia Burgess devices PCD1.M0xx0, PCD1.M2xx0, PCD2.M5xx0, PCD3.Mxx60, PCD3.Mxxx0, PCD7.D4xxD, PCD7.D4xxV, PCD7.D4xxWTPF, PCD7.D4xxxT5F, and PCD3.T665 and PCD3.T666 before versions 1.24.50 and 1.24.41 have hardcoded credentials, allowing remote attackers to gain administrative access via an FTP session.
EMC Isilon OneFS versions 7.1 before 7.1.1.8, 7.2.0 before 7.2.0.4, and 7.2.1 before 7.2.1.1 allow remote authenticated administrators to bypass a SmartLock root-login restriction by creating a root account and establishing a login session.
A stack-based buffer overflow in the GoAhead Web Server on Schneider Electric Modicon M340 PLC BMXNOx and BMXPx devices allows remote attackers to execute arbitrary code via a long password in HTTP Basic Authentication data.
SearchBlox 8.3 before 8.3.1 allows remote attackers to write to the config file, potentially leading to application crashes.
Honeywell Midas gas detectors before 1.13b3 and Midas Black gas detectors before 2.13b3 allow remote attackers to discover cleartext passwords by sniffing the network.
CVE-2015-7907 describes a directory traversal vulnerability in the web server of Honeywell Midas gas detectors before version 1.13b3 and Midas Black before version 2.13b3. It allows remote attackers to bypass authentication and write to a configuration file or trigger calibration or testing.
LOYTEC LIP-3ECTB 6.0.1, LINX-100, LVIS-3E100, and LIP-ME201 devices allow remote attackers to read a password-hash backup file via unspecified vectors.
The login function in the RequestController class in Moxa OnCell Central Manager before version 2.2 has a hardcoded root password, allowing remote attackers to gain administrative access via a login session.
The MessageBrokerServlet servlet in Moxa OnCell Central Manager before version 2.2 does not require authentication, allowing remote attackers to gain administrative access via a command, such as the addUserAndGroup action.
Apache HBase versions before 0.98.12.1, 1.0.1.1, and 1.1.0.1, as used in IBM InfoSphere BigInsights, have incorrect ACLs for ZooKeeper coordination state. This allows remote attackers to cause a denial of service, obtain sensitive information, or modify data via unspecified client traffic.
The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2, mishandles simple unauthenticated and anonymous bind configurations, allowing remote attackers to bypass authentication via a crafted LDAP request.
Serialized-object interfaces in VMware vRealize Orchestrator 6.x, vCenter Orchestrator 5.x, vRealize Operations 6.x, vCenter Operations 5.x, and vCenter Application Discovery Manager 7.x allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
Wersje Juniper ScreenOS od 6.2.0r15 do 6.2.0r18 oraz od 6.3.0r12 do 6.3.0r20 przed odpowiednimi poprawkami umożliwiają zdalnym atakującym uzyskanie dostępu administracyjnego poprzez wprowadzenie nieokreślonego hasła podczas sesji SSH lub TELNET.
Cisco Prime Network Services Controller version 3.0 allows local users to bypass intended access restrictions and execute arbitrary commands via additional parameters to an unspecified command.
The boot manager in Cisco Application Policy Infrastructure Controller (APIC) version 1.1(0.920a) allows local users to bypass intended access restrictions and obtain single-user-mode root access via unspecified vectors.
The SysAdminWebTool servlets in SAP Mobile Platform allow remote attackers to bypass authentication, enabling them to obtain sensitive information, gain privileges, or have unspecified other impacts.
CVE-2015-8369 is an SQL injection vulnerability in include/top_graph_header.php in Cacti version 0.8.8f and earlier. It allows remote attackers to execute arbitrary SQL commands via the rra_id parameter in a properties action to graph.php.
The libxl toolstack library in Xen versions 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process. This allows attackers to cause a denial of service by starting domains.
Xen 4.6.x and earlier does not properly enforce limits on page order inputs for certain memory operations, which may lead to denial of service.