CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An unspecified vulnerability in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows remote attackers to execute arbitrary Java code via serialized data to the JMS port.
Apache CloudStack before version 4.5.2 does not properly preserve VNC passwords when migrating KVM virtual machines, allowing remote attackers to gain access by connecting to the VNC server.
The Smack XMPP API in Ignite Realtime, used in Atlassian Bamboo before version 5.9.9 and 5.10.x before 5.10.0, allows remote configured XMPP servers to execute arbitrary Java code via serialized data in an XMPP message.
OpenELEC and RasPlex devices have a hardcoded password for the root account, making it easier for remote attackers to gain access via an SSH session.
The nf_nat_redirect_ipv4 function in the Linux kernel before version 4.4 allows remote attackers to cause a denial of service through a NULL pointer dereference, leading to system crashes. This issue is related to CVE-2003-1604.
The NuPlayer::GenericSource::notifyPreparedAndCleanup function in mediaserver in Android 5.x before version 5.1.1 LMY49G and 6.x before 2016-02-01 improperly manages mDrmManagerClient objects. This allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.
libstagefright in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 has a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file. This issue affects the SoftMPEG4Encoder and SoftVPXEncoder components.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted wireless control message packets.
The Sauter EY-WS505F0x0 module before version 1.6.0 sends cleartext credentials, allowing remote attackers to obtain sensitive information by sniffing the network.
Openshift allows remote attackers to gain privileges by updating a build configuration that was created with an allowed type to a type that is not allowed.
The filesystem storage backend in Radicale before version 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path.
The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name.
The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
The MoofParser::Metadata function in libstagefright in Mozilla Firefox before version 44.0 does not limit the size of read operations, which may allow remote attackers to cause a denial of service (integer overflow and buffer overflow) or possibly have unspecified other impact via crafted metadata.
The Buffer11::NativeBuffer11::map function in ANGLE, as used in Mozilla Firefox before version 44.0, might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before version 44.0 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to uninitialized memory encountered during brotli data compression, and other vectors.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 44.0 and Firefox ESR 38.x before 38.6 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.
HPE Operations Manager versions 8.x and 9.0 on Windows allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
Westermo WeOS before version 4.19.0 uses the same SSL private key across different customers' installations, making it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a key.
McPvDrv.sys version 4.6.111.0 in McAfee File Lock 5.x and McAfee Total Protection allows local users to obtain sensitive information from kernel memory or cause a system crash via a large VERIFY_INFORMATION.Length value in an IOCTL_DISK_VERIFY ioctl call.