CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.05)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which might allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate.
Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.
MEDHOST Perioperative Information Management System (PIMS or VPIMS) before version 2015R1 has hardcoded credentials, making it easier for remote attackers to obtain sensitive information via direct requests to the application database server.
The Chef Manage add-on before version 1.12.0 allows remote attackers to execute arbitrary code via crafted serialized data in a cookie.
EMC NetWorker versions 8.2.1.x and 8.2.2.x before 8.2.2.6 and 9.x before 9.0.0.6 mishandle authentication, allowing remote attackers to execute arbitrary commands by leveraging access to a different NetWorker instance.
A format string vulnerability in libxml2 before version 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.
The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors related to connecting to a guest VM, which triggers a heap-based buffer overflow.
CVE-2016-4532 describes a vulnerability in the WAP interface of Trihedral VTScada in versions 8.x through 11.x before 11.2.02, allowing remote attackers to read arbitrary files via a crafted pathname.
The WAP interface in Trihedral VTScada in versions 8.x through 11.x before 11.2.02 allows remote attackers to bypass authentication and read arbitrary files via unspecified vectors.
General Electric (GE) Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware before 5.5.0 and ML810, ML3000, and ML3100 switches with firmware before 5.5.0k have hardcoded credentials, allowing remote attackers to modify configuration settings via the web interface.
Buffer overflow in the DecodeAdpcmImaQT function in VideoLAN VLC media player before version 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.
HPE Universal CMDB versions 10.0 through 10.21, Universal CMDB Configuration Manager versions 10.0 through 10.21, and Universal Discovery versions 10.0 through 10.21 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
HPE Systems Insight Manager (SIM) before 7.5.1 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unspecified vectors.
The Performance Center Virtual Table Server (VTS) component in HPE LoadRunner has a vulnerability that allows remote attackers to delete arbitrary files. The issue is due to unrestricted file path access in unlink calls.
A stack-based buffer overflow in mchan.dll in the agent of HPE LoadRunner and Performance Center allows remote attackers to execute arbitrary code. This issue affects versions 11.52, 12.00, 12.01, 12.02, and 12.50, along with their respective patches.
HPE Matrix Operating Environment before 7.5.1 allows remote attackers to obtain sensitive information or modify data via unspecified vectors.
HPE Insight Control before version 7.5.1 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unspecified vectors.
HPE Systems Insight Manager (SIM) before 7.5.1 allows remote attackers to obtain sensitive information or modify data via unspecified vectors.
Apache Struts versions 2.3.19 to 2.3.28 with Dynamic Method Invocation enabled allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.
Apache Shiro w wersjach przed 1.2.5, gdy klucz szyfrujący nie został skonfigurowany dla funkcji 'zapamiętaj mnie', umożliwia zdalnym atakującym wykonanie dowolnego kodu lub ominięcie zamierzonych ograniczeń dostępu poprzez nieokreślony parametr żądania.