CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
IBM Security Guardium 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands.
IBM Maximo Asset Management versions 7.1, 7.5, and 7.6 are vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.
IBM Security Guardium versions 10.0 and 10.1 are vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, allowing them to view, add, modify, or delete information in the back-end database.
The grant-table feature in Xen through 4.8.x does not ensure sufficient type counts for GNTMAP_device_map and GNTMAP_host_map mapping, which may lead to denial of service or privileged host OS access.
The grant-table feature in Xen through 4.8.x mishandles a GNTMAP_device_map and GNTMAP_host_map mapping, which can lead to count mismanagement and memory corruption. Guest OS users can cause a denial of service or gain privileged host OS access.
Xen through 4.8.x does not validate memory allocations during certain P2M operations, allowing guest OS users to obtain privileged host OS access, known as XSA-222.
Xen versions up to 4.8.x do not validate the port numbers of polled event channel ports, allowing guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) or possibly obtain sensitive information.
The shadow-paging feature in Xen through 4.8.x mismanages page references, leading to a race condition. This allows guest OS users to obtain Xen privileges, known as XSA-219.
The grant-table feature in Xen through 4.8.x provides false mapping information in certain cases of concurrent unmap calls, allowing backend attackers to obtain sensitive information or gain privileges.
Xen through 4.8.x mishandles page transfer, which allows guest OS users to obtain privileged host OS access, aka XSA-217.
In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, remote attackers can bypass authentication under certain circumstances because parameters containing 0x00 characters are truncated before reaching the database layer.
JabberD 2.x before version 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled.
An issue was discovered on Humax Digital HG100 2.0.6 devices that allows an attacker to find root credentials in the backup file, known as GatewaySettings.bin.
An issue was discovered on Humax Digital HG100R 2.0.6 devices that allows downloading the backup file without the need for credentials. Additionally, the router credentials are stored in plaintext inside the backup file, known as GatewaySettings.bin.
W bibliotece Telerik.Web.UI.dll w Progress Telerik UI dla ASP.NET AJAX przed R2 2017 SP1 oraz Sitefinity przed wersją 10.0.6412.0 występuje niewłaściwa ochrona klucza szyfrowania Telerik.Web.UI.DialogParametersEncryptionKey oraz MachineKey. To ułatwia zdalnym atakującym obejście mechanizmów ochrony kryptograficznej, co może prowadzić do wycieku MachineKey, nieautoryzowanego przesyłania lub pobierania plików, ataków XSS lub kompromitacji ASP.NET ViewState.
An Improper Authentication issue was discovered in Newport XPS-Cx and XPS-Qx. An attacker may bypass authentication by accessing a specific uniform resource locator (URL).
The management interface for the Teltonika RUT9XX routers (aka LuCI) with firmware 00.03.265 and earlier allows remote attackers to execute arbitrary commands with root privileges via shell metacharacters in the username parameter in a login request.
The DBD::mysql module through 4.043 for Perl allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by triggering certain error responses from a MySQL server or a loss of a network connection to a MySQL server.
Versions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safe_load, allowing the potential for arbitrary code execution on the server. The fix for this is to call YAML.safe_load on input.
In avcodec 2.2.x, used in VideoLAN VLC media player 2.2.7-x before June 29, 2017, there is a flaw that allows out-of-bounds heap memory write. This is due to an incorrect size passed to memcpy(), leading to application crashes or potentially code execution.