CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in Cisco Meeting Server and Meeting App could allow an unauthenticated, remote attacker to execute arbitrary code on an affected system. This affects versions of Cisco Meeting Server prior to 2.0.1 and other listed applications.
A vulnerability in the Transaction Language 1 (TL1) code of Cisco ASR 900 Series routers could allow an unauthenticated, remote attacker to cause a reload of, or remotely execute code on, the affected system.
The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 is vulnerable to an SQL Injection attack.
SAP ASE version 16.0 SP02 PL03 and prior allows attackers who own SourceDB and TargetDB databases to elevate privileges to sa (system administrator) via dbcc import_sproc SQL injection.
Exponent CMS versions before 2.3.9 are vulnerable to an attacker uploading a malicious script file via redirection, allowing the script to be placed in an unprotected folder that permits script execution.
git-fastclone before 1.0.5 passes user modifiable strings directly to a shell command. An attacker can execute malicious commands by modifying the strings that are passed as arguments to 'cd ' and 'git clone ' commands.
On Samsung Galaxy S4 through S7 devices, an integer overflow condition exists within libomacp.so when parsing OMACP messages, leading to heap corruption. This can result in Denial of Service and potentially remote code execution.
A buffer overflow vulnerability was observed in the divby function of MuJS before version 8c805b4eb19cf2af689c860b77e6111d2ee439d5. Successful exploitation of this issue can lead to code execution or denial of service condition.
A use-after-free vulnerability was observed in the Rp_toString function of MuJS before version 5c337af4b3df80cf967e4f9f6a21522de84b392a. Successful exploitation can lead to code execution or denial of service condition.
Buffer overflow in the zmq interface in csp_if_zmqhub.c in the libcsp library v1.4 and earlier allows hostile computers connected via a zmq interface to execute arbitrary code via a long packet.
Buffer overflow in the csp_sfp_recv_fp function in csp_sfp.c in the libcsp library v1.4 and earlier allows hostile components with network access to the SFP underlying network layers to execute arbitrary code via specially crafted SFP packets.
Buffer overflow in the csp_can_process_frame function in the libcsp library v1.4 and earlier allows hostile components connected to the canbus to execute arbitrary code via a long csp packet.
A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and retrieve database information or read local system files via MySQL's LOAD_FILE.
PHP object injection vulnerabilities exist in multiple widget files in AlienVault OSSIM and USM before version 5.3.2. These vulnerabilities allow arbitrary PHP code execution via magic methods in included classes.
A buffer overflow in Redis versions 3.2.x prior to 3.2.4 can lead to arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in the handling of the client-output-buffer-limit option during the CONFIG SET command.
A vulnerability in the interdevice communications interface of the Cisco IP Interoperability and Collaboration System (IPICS) Universal Media Services (UMS) could allow an unauthenticated, remote attacker to modify configuration parameters of the UMS and cause the system to become unavailable.
A vulnerability in the XMPP service of Cisco Meeting Server (CMS) before version 2.0.6 and Acano Server before version 1.8.18 and 1.9.x before 1.9.6 allows an unauthenticated attacker to masquerade as a legitimate user. The issue is due to the XMPP service incorrectly processing a deprecated authentication scheme.
Unspecified vulnerability in the Oracle VM VirtualBox component before 5.1.4 in Oracle Virtualization allows remote attackers to affect confidentiality and integrity via vectors related to VRDE.
Unspecified vulnerability in the Oracle Advanced Supply Chain Planning component in Oracle Supply Chain Products Suite versions 12.2.3 through 12.2.5 allows remote attackers to affect confidentiality and integrity via vectors related to MscObieeSrvlt.
Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot.