CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Google Chrome before 48.0.2564.116 allows remote attackers to bypass the Blink Same Origin Policy and a sandbox protection mechanism via unspecified vectors.
The Data Protection component in the VMware vSphere GUI in IBM Tivoli Storage Manager for Virtual Environments before version 6.3.2.5, 6.4.3.1, and 7.1.4, as well as Tivoli Storage FlashCopy Manager for VMware before version 3.1.1.3, 3.2.0.6, and 4.1.4, allows remote attackers to obtain administrative privileges via a crafted URL that triggers back-end function execution.
The web interface on Advantech/B+B SmartWorx VESP211-EU devices with firmware 1.7.2 and VESP211-232 devices with firmware 1.5.1 and 1.7.2 relies on the client to implement access control, allowing remote attackers to perform administrative actions via modified JavaScript code.
SQL injection vulnerability in the Help plug-in 1.3.5 and earlier in Cuore EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote authenticated users to execute arbitrary OS commands by leveraging console administrator access.
Zhuhai RaySharp firmware has a hardcoded root password, which makes it easier for remote attackers to obtain access via a session on TCP port 23 or 9000.
The cliserver implementation in Dell SonicWALL GMS, Analyzer, and UMA EM5000 versions 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote attackers to deserialize and execute arbitrary Java code via crafted XML data.
The GMS ViewPoint web application in Dell SonicWALL GMS, Analyzer, and UMA EM5000 versions 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote authenticated users to execute arbitrary commands via configuration input.
Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway versions 11.x before 11.0 Build 64.34, 10.5 before 10.5 Build 59.13, and 10.5.e before Build 59.1305.e allow remote attackers to gain privileges via unspecified NS Web GUI commands.
Podatność na wstrzykiwanie SQL w serwerze UDDI w SAP NetWeaver J2EE Engine 7.40 umożliwia zdalnym atakującym wykonywanie dowolnych poleceń SQL poprzez nieokreślone wektory. Jest to związane z notą bezpieczeństwa SAP 2101079.
A use-after-free vulnerability in the resolver in nginx versions 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or possibly have unspecified other impact via a crafted DNS response related to CNAME response processing.
The Windows-based Host Interface Program (WHIP) service on Huawei SmartAX MT882 devices V200R002B022 Arg relies on the client to send a length field that is consistent with a buffer size. This allows remote attackers to cause a denial of service (device outage) or possibly have unspecified other impact via crafted traffic on TCP port 8701.
Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 version 1.5.0.11 and earlier allow remote attackers to execute arbitrary Java code by uploading a JSP file.
HP Continuous Delivery Automation (CDA) version 1.30 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
Buffer overflow in the IKEv1 and IKEv2 implementations in Cisco ASA Software before versions 8.4(7.30), 8.7 before 8.7(1.18), 9.0 before 9.0(4.38), and others allows remote attackers to execute arbitrary code or cause a denial of service via crafted UDP packets.
Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Photoshop CC 2014 before version 15.2.4, Photoshop CC 2015 before version 16.1.2, and Bridge CC before version 6.2 have a vulnerability that allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Connect before version 9.5.2 allows remote attackers to have an unspecified impact via a crafted parameter in a URL.
Multiple unspecified services in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 do not require authentication, allowing remote attackers to obtain sensitive information, modify settings, or manage build agents.