CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
VMware vSphere Client versions 4.0, 4.1, 5.0 before Update 3, and 5.1 before Update 2 improperly validate updates to Client files, allowing remote attackers to trigger the downloading and execution of an arbitrary program.
The Modbus slave/outstation driver in IOServer OPC Server version 1.0.20 and earlier allows remote attackers to cause a denial of service through a crafted packet, leading to out-of-bounds read and daemon crash.
The network interface configuration page in Sophos Web Appliance before version 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in the address parameter.
The Change Password dialog box in Sophos Web Appliance before version 3.8.2 allows remote authenticated users to change the admin user password via a crafted request.
SQL injection vulnerability in default.asp in CIS Manager CMS allows remote attackers to execute arbitrary SQL commands via the TroncoID parameter.
SQL injection vulnerability in OrbitScripts Orbit Open Ad Server before version 1.1.1 allows remote attackers to execute arbitrary SQL commands via the site_directory_sort_field parameter to guest/site_directory.
MongooseIM through version 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, allowing remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, known as an 'xmppbomb' attack.
The net/IOService.java file in Tigase before version 5.2.1 does not properly restrict the processing of compressed XML elements, allowing remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, known as an 'xmppbomb' attack.
Prosody before 0.9.4 does not properly restrict the processing of compressed XML elements, allowing remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, known as an 'xmppbomb' attack.
The mod_compression.lua plugin in Prosody before version 0.9.4 and Lightwitch Metronome through version 3.4 negotiates stream compression while a session is unauthenticated. This allows remote attackers to cause a denial of service via compressed XML elements in an XMPP stream, known as an 'xmppbomb' attack.
The mod_compression.lua plugin in Lightwitch Metronome up to version 3.4 does not properly restrict the processing of compressed XML elements, allowing remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, known as an 'xmppbomb' attack.
Isode M-Link before version 16.0v7 does not properly restrict the processing of compressed XML elements, allowing remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, known as an 'xmppbomb' attack.
In Openfire versions before 3.9.2, there is a vulnerability in nio/XMLLightweightParser.java that does not properly restrict the processing of compressed XML elements. This allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, known as an 'xmppbomb' attack.
SAP Business Object Processing Framework (BOPF) for ABAP has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
SAP Print and Output Management has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
The Security Audit Log facility in SAP Enhancement Package (EHP) 6 for SAP ERP 6.0 allows remote attackers to modify or delete arbitrary log classes via unspecified vectors.
SAP Enterprise Portal does not properly restrict access to the Federation configuration pages, allowing remote attackers to gain privileges via unspecified vectors.
An unspecified J2EE core service in the J2EE Engine in SAP NetWeaver does not properly restrict access, allowing remote attackers to read and write to arbitrary files via unknown vectors.
An unspecified vulnerability in the Diagnostics (SMD) agent in SAP Solution Manager allows remote attackers to obtain sensitive information, modify application configurations, and install or remove applications via vectors involving the P4 protocol.
An unspecified RFC function in SAP CCMS Agent allows remote attackers to execute arbitrary commands via unknown vectors.