CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in Epicor Procurement before version 7.4 SP2 allows remote attackers to execute arbitrary SQL commands via the User field.
BMC Track-It! version 11.3.0.355 does not require authentication on TCP port 9010, allowing remote attackers to upload arbitrary files, execute arbitrary code, or obtain sensitive credential and configuration information via a .NET Remoting request to FileStorageService or ConfigurationService.
The Clientless SSL VPN portal in Cisco ASA Software before version 8.2(5.51), 8.3(2.42), 8.4(7.23), 8.6(1.15), 9.0(4.24), 9.1(5.12), 9.2(2.8), and 9.3(1.1) allows remote attackers to obtain sensitive information from process memory or modify memory contents via crafted parameters.
The VPN implementation in Cisco ASA Software versions before 7.2(5.15), 8.2(5.51), 8.3(2.42), 8.4(7.23), 8.6(1.15), 9.0(4.24), 9.1(5.12), 9.2(2.6), and 9.3(1.1) does not properly implement a tunnel filter, allowing remote authenticated users to gain failover-unit access via crafted packets.
The DNS inspection engine in Cisco ASA Software 9.0 before 9.0(4.13), 9.1 before 9.1(5.7), and 9.2 before 9.2(2) allows remote attackers to cause a denial of service (device reload) via crafted DNS packets.
The SunRPC inspection engine in Cisco ASA Software before versions 7.2(5.14), 8.2(5.51), 8.3(2.42), 8.4(7.23), 8.5(1.21), 8.6(1.14), 8.7(1.13), 9.0(4.5), and 9.1(5.3) allows remote attackers to cause a denial of service (device reload) via crafted SunRPC packets.
The GPRS Tunneling Protocol (GTP) inspection engine in Cisco ASA Software before version 8.2(5.51), 8.4(7.15), 8.7(1.13), 9.0(4.8), and 9.1(5.1) allows remote attackers to cause a denial of service (device reload) via a crafted series of GTP packets.
A race condition in the Health and Performance Monitoring (HPM) for ASDM feature in Cisco ASA allows remote attackers to cause a denial of service by generating many half-open TCP connections simultaneously.
The IKEv2 implementation in Cisco ASA Software before versions 8.4(7.15), 8.6(1.14), 9.0(4.8), and 9.1(5.1) allows remote attackers to cause a denial of service by sending a crafted packet during tunnel creation.
The IKE implementation in the VPN component in Cisco ASA Software 9.1 before 9.1(5.1) allows remote attackers to cause a denial of service (device reload) via crafted UDP packets.
The SQL*Net inspection engine in Cisco ASA Software before versions 7.2(5.13), 8.2(5.50), 8.3(2.42), 8.4(7.15), 8.5(1.21), 8.6(1.14), 8.7(1.13), 9.0(4.5), and 9.1(5.1) allows remote attackers to cause a denial of service (device reload) via crafted SQL REDIRECT packets.
The file comment feature in Rejetto HTTP File Server (hfs) 2.3c and earlier allows remote attackers to execute arbitrary code by uploading a file with certain invalid UTF-8 byte sequences that are interpreted as executable macro symbols.
The actionSendErrorReport method in protected/controllers/SiteController.php in X2Engine versions 2.8 through 4.1.7 allows remote attackers to conduct PHP object injection and Server-Side Request Forgery (SSRF) attacks via crafted serialized data in the report parameter.
Unspecified vulnerability in HP Operations Manager 9.20 on UNIX allows remote attackers to execute arbitrary code via unknown vectors.
Unspecified vulnerability in HP Operations Manager 9.10 and 9.11 on UNIX allows remote attackers to execute arbitrary code via unknown vectors.
Unspecified vulnerability in HP Network Automation 9.10 and 9.20 allows local users to bypass intended access restrictions via unknown vectors.
Unspecified vulnerability in HP Sprinter 12.01 allows remote attackers to execute arbitrary code via unknown vectors.
Unspecified vulnerability in HP Sprinter 12.01 allows remote attackers to execute arbitrary code via unknown vectors.
Unspecified vulnerability in HP Sprinter 12.01 allows remote attackers to execute arbitrary code via unknown vectors.
Unspecified vulnerability in HP Sprinter 12.01 allows remote attackers to execute arbitrary code via unknown vectors.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS