CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
EMC Isilon InsightIQ versions 4.1.0, 4.0.1, 4.0.0, 3.2.2, 3.2.1, 3.2.0, 3.1.1, 3.1.0, 3.0.1, 3.0.0 are affected by an authentication bypass vulnerability that could potentially be exploited by attackers to compromise the affected system.
CVE-2016-8418 identifies a remote code execution vulnerability in the Qualcomm crypto driver that could allow a remote attacker to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of remote code execution in the kernel context.
Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.
NetApp OnCommand Unified Manager for Clustered Data ONTAP versions 6.3 through 6.4P1 contain a default privileged account, allowing remote attackers to execute arbitrary code via unspecified vectors.
NetApp Virtual Storage Console for VMware vSphere before version 6.2.1 uses a non-unique certificate, allowing remote attackers to conduct man-in-the-middle attacks via unspecified vectors.
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
Multiple SQL injection vulnerabilities in Exponent CMS before version 2.4.0 allow remote attackers to execute arbitrary SQL commands through various parameters such as id, title, and content_id.
The ObjectSocketWrapper.java in Gradle 2.12 has a vulnerability that allows remote attackers to execute arbitrary code via a crafted serialized object.
Eval injection vulnerability in php-gettext 1.0.12 and earlier allows remote attackers to execute arbitrary PHP code via a crafted plural forms header.
The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.
PEAR HTML_AJAX versions 0.3.0 through 0.5.7 has a PHP Object Injection Vulnerability in the PHP Serializer, allowing remote code execution. The root cause is an incorrect regular expression.
Heap-based buffer overflow in the EscapeParenthesis function in GraphicsMagick before version 1.3.25 can be exploited by remote attackers.
Buffer overflow in the MVG and SVG rendering code in GraphicsMagick 1.3.24 allows remote attackers to have unspecified impact via unknown vectors. This vulnerability exists due to an incomplete patch for CVE-2016-2317.
An issue was discovered in Exponent CMS 2.4.1 related to blind SQL injection that can be exploited by unauthenticated users via an HTTP GET request. This vulnerability allows for dumping database data to a malicious server.
The installation wizard in DotNetNuke (DNN) before version 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.
A use-after-free vulnerability in the kvm_ioctl_create_device function in the Linux kernel before version 4.8.13 allows host OS users to cause a denial of service (host OS crash) or possibly gain privileges via crafted ioctl calls on the /dev/kvm device.
An issue was discovered on SendQuick Entera and Avera devices before 2HF16. Multiple Command Injection vulnerabilities allow attackers to execute arbitrary system commands.
EMC Network Configuration Manager (NCM) versions 9.3.x and 9.4.x contain an Improper Authentication vulnerability that could be exploited by malicious users to compromise the affected system.
EMC Network Configuration Manager (NCM) versions 9.3.x and 9.4.x contain a Java RMI Remote Code Execution vulnerability. This could be exploited by malicious users to compromise the affected system.
EMC Documentum eRoom version 7.4.4 and earlier contains an unverified password change vulnerability that could be exploited by malicious users to compromise the system.