CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Integer overflow in Git before version 2.7.4 allows remote attackers to execute arbitrary code via (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.
In git versions before 2.7.4, there is a bug in revision.c that uses an incorrect integer data type. This allows remote attackers to execute arbitrary code via (1) long filenames or (2) many nested trees, leading to a heap-based buffer overflow.
Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.
A stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY before 0.66.6.3 allows remote servers to cause a denial of service or execute arbitrary code via a crafted SCP-SINK file-size response to an SCP download request.
Jenkins before version 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, making it easier for remote attackers to bypass the CSRF protection mechanism via a brute-force approach.
The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by opening a JRMP listener.
Multiple buffer overflows in the XML Parser library in Apache Xerces-C before version 3.1.3 allow remote attackers to cause a denial of service (segmentation fault or memory corruption) or possibly execute arbitrary code via a crafted document.
The XXE vulnerability in the Configuration Wizard in SAP NetWeaver Java AS versions 7.1 to 7.5 allows remote attackers to cause denial of service, conduct SMB Relay attacks, or access arbitrary files via a crafted XML request.
Adobe Flash Player w wersji 21.0.0.197 i wcześniejszych umożliwia zdalnym atakującym spowodowanie odmowy usługi (awaria aplikacji) lub potencjalne wykonanie dowolnego kodu poprzez nieokreślone wektory. Wykorzystanie tej podatności miało miejsce w praktyce w kwietniu 2016 roku.
Cisco UCS Invicta C3124SA devices from versions 4.3.1 to 5.0.1, UCS Invicta Scaling System, and Whiptail Racerunner improperly store a default SSH private key. This allows remote attackers to gain root access via unspecified vectors.
Cisco Prime Infrastructure versions 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) version 1.2 are vulnerable to remote code execution by attackers who can exploit crafted deserialized data in an HTTP POST request.
The FTP server in Pro-face GP-Pro EX EX-ED before version 4.05.000 has hardcoded credentials, allowing remote attackers to bypass authentication.
HPE Asset Manager versions 9.40, 9.41, and 9.50 and Asset Manager CloudSystem Chargeback version 9.40 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command.
Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command.
Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command.
Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command.
Patterson Dental Eaglesoft 17 has a hardcoded password of 'sql' for the dba account, allowing remote attackers to obtain sensitive Dental.DB patient information via SQL statements.
A use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service (memory corruption and application crash) by triggering a wddx_deserialize call on XML data containing a crafted var element.
libxml2 in Apple iOS before 9.3, OS X before 10.11.4, and watchOS before 2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.