CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2015-8789 is a use-after-free vulnerability in the EbmlMaster::Read function in libEBML before version 1.3.3. It allows context-dependent attackers to have unspecified impact via a 'deeply nested element with infinite size' followed by another upper-level element in an EBML document.
A stack-based buffer overflow on Rockwell Automation Allen-Bradley MicroLogix 1100 devices A through 15.000 and B before 15.002 allows remote attackers to execute arbitrary code via a crafted web request.
CVE-2015-6319 is a vulnerability in the web-based management interface on Cisco RV220W devices that allows remote attackers to execute arbitrary SQL commands via a crafted header in an HTTP request.
A race condition in the initialization process on Lexmark printers with firmware ATL before ATL.02.049, CB before CB.02.049, PP before PP.02.049, and YK before YK.02.049 allows remote attackers to bypass authentication by leveraging incorrect detection of the security-jumper status.
Multiple unspecified vulnerabilities in Google V8 before version 4.8.271.17, as used in Google Chrome before version 48.0.2564.82, may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before January 20, 2016, has a hardcoded password for the 1MB@tMaN account. This makes it easier for remote attackers to gain access via an SSH or HTTP session.
The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before 2015-10-12 has a hardcoded password for the BlackWidow account, making it easier for remote attackers to gain access via SSH or HTTP sessions.
An unspecified CGI script in Cisco FX-OS before version 1.1.2 on Firepower 9000 devices and in Cisco UCS Manager before versions 2.2(4b), 2.2(5) before 2.2(5a), and 3.0 before 3.0(2e) allows remote attackers to execute arbitrary shell commands via a crafted HTTP request.
Cisco Modular Encoding Platform D9036 software before version 02.04.70 has hardcoded root and guest passwords, making it easier for remote attackers to gain access via an SSH session.
The XS engine in SAP HANA allows remote attackers to spoof log entries in trace files, potentially leading to denial of service (disk consumption and process crash) via a crafted HTTP request.
Buffer overflow in the XS engine (hdbxsengine) in SAP HANA allows remote attackers to cause a denial of service or execute arbitrary code via a crafted HTTP request, related to JSON.
Integer overflow in the authenticate_post function in CGit before version 0.12 allows remote attackers to have unspecified impact via a large value in the Content-Length HTTP header, leading to a buffer overflow.
The gdImageRotateInterpolated function in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 allows remote attackers to obtain sensitive information or cause a denial of service via a large bgd_color argument to the imagerotate function.
CVE-2015-8617 describes a format string vulnerability in the zend_throw_or_error function in PHP 7.x before version 7.0.1. This allows remote attackers to execute arbitrary code via format string specifiers in a string misused as a class name, leading to incorrect error handling.
Seeds acmailer before 3.8.21 and 3.9.x before 3.9.15 Beta allows remote authenticated users to execute arbitrary OS commands via unspecified vectors.
Fortinet FortiAnalyzer, FortiSwitch, FortiCache, and FortiOS have a hardcoded passphrase for the Fortimanager_Access account, allowing remote attackers to gain administrative access via an SSH session.
Integer overflow in the Kernel service in Advantech WebAccess before version 8.1 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted RPC request.
Multiple heap-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors.
Multiple stack-based buffer overflows in Advantech WebAccess before version 8.1 allow remote attackers to execute arbitrary code via unspecified vectors.
CVE-2016-0854 describes an unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in Advantech WebAccess before version 8.1. This allows remote attackers to write to files of arbitrary types via unspecified vectors.