CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in SAP HANA Web-based Development Workbench allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2015-2282 involves a stack-based buffer overflow in the LZC decompression implementation in various SAP products, potentially leading to a denial of service or arbitrary code execution by attackers.
The Git plugin for FusionForge before version 6.0rc4 allows remote attackers to execute arbitrary code via an unspecified parameter when creating a secondary Git repository.
The installer in NetApp OnCommand Workflow Automation before version 2.2.1P1 and 3.x before version 3.0P1 sets up the Java Debugging Wire Protocol (JDWP) service, allowing remote attackers to execute arbitrary code via unspecified vectors.
IBM PowerVC versions 1.2.0.x through 1.2.0.4, 1.2.1.x through 1.2.1.2, and 1.2.2.x through 1.2.2.2 do not require authentication for the ceilometer NoSQL database. This allows remote attackers to read or write to arbitrary database records, potentially gaining administrator privileges.
Cisco DTA Control System (DTACS) version 4.0.0.9 and Cisco Headend System Release are vulnerable to remote attacks that can lead to denial of service through excessive CPU and memory consumption and TCP service outage. Attackers can exploit a SYN flood or another type of TCP traffic flood.
The EdgeServiceImpl web service in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive credentials via a crafted SOAP request to the (1) getBackupPolicy or (2) getBackupPolicies method.
Podatność na przejście do katalogu w Arcserve UDP przed wersją 5.0 Update 4 pozwala zdalnym atakującym na uzyskanie wrażliwych informacji lub spowodowanie odmowy usługi poprzez spreparowaną ścieżkę pliku do serwletu (1) reportFileServlet lub (2) exportServlet.
Integer overflow in the libnv6 module in Dell NetVault Backup before version 10.0.5 allows remote attackers to execute arbitrary code via crafted template string specifiers in a serialized object, triggering a heap-based buffer overflow.
CVE-2015-4060 involves a heap-based buffer overflow in the TermProxy (WLTermProxyService.exe) service in Wavelink ConnectPro, which can be exploited by remote attackers to execute arbitrary code via a large HTTP header.
Heap-based buffer overflow in the License Server (LicenseServer.exe) in Wavelink Terminal Emulation (TE) allows remote attackers to execute arbitrary code via a large HTTP header.
In IPsec-Tools version 0.8.2, a vulnerability allows remote attackers to cause the IKE daemon to crash by sending a series of crafted UDP requests, leading to a NULL pointer dereference.
In the Developer tools of Visual Mining NetCharts Server, the projectContents.jsp file allows remote attackers to rename arbitrary files, potentially leading to their execution.
Directory traversal vulnerability in saveFile.jsp in the development installation of Visual Mining NetChart allows remote attackers to write to arbitrary files via unspecified vectors.
The nbd-server.c file in Network Block Device (nbd-server) before version 3.11 does not properly handle signals, allowing remote attackers to cause a denial of service (deadlock) via unspecified vectors.
Cisco Finesse version 10.5(1) allows remote authenticated users to obtain sensitive information or cause a denial of service (CPU and memory consumption) via a crafted XML document.
Cisco IP Phone 7861 with firmware from Cisco Unified Communications Manager 10.3(1) allows remote attackers to cause a denial of service via crafted packets.
AVM Fritz!Box allows remote attackers to execute arbitrary commands via shell metacharacters in the var:lang parameter to cgi-bin/webcm.
The modern style negotiation in Network Block Device (nbd-server) versions 2.9.22 through 3.3 allows remote attackers to cause a denial of service by terminating the root process. This can be achieved by closing the connection during negotiation or specifying a name for a non-existent export.
SQL injection vulnerability in related.php in Milw0rm Clone Script 1.0 allows remote attackers to execute arbitrary SQL commands via the program parameter.