CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A double free vulnerability in the dsa_priv_decode function in OpenSSL before version 1.0.1s and 1.0.2 before version 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.
Cisco Nexus 3000 and 3500 devices running NX-OS versions 6.0(2)U6(1) to 6.0(2)U6(5) and 6.0(2)A6(1) to 6.0(2)A6(5) and 6.0(2)A7(1) contain hardcoded credentials. This allows remote attackers to gain root privileges via a TELNET or SSH session.
A stack-based buffer overflow in IBM Tivoli Storage Manager FastBack versions 5.5 and 6.1.x through 6.1.11.1 allows remote attackers to cause a daemon crash.
A stack-based buffer overflow in IBM Tivoli Storage Manager FastBack versions 5.5 and 6.1.x through 6.1.11.1 allows remote attackers to cause a daemon crash.
A stack-based buffer overflow in IBM Tivoli Storage Manager FastBack versions 5.5 and 6.1.x through 6.1.11.1 allows remote attackers to cause a daemon crash.
The FTP service in QNAP iArtist Lite before version 1.4.54, as distributed with QNAP Signage Station before version 2.0.1, has hardcoded credentials, making it easier for remote attackers to gain access via a session on TCP port 21.
Cisco Nexus 2000 Fabric Extender devices running NX-OS versions 7.0(1)N1(1), 7.0(1)N1(3), and 7.0(4)N1(1) have a blank root password, allowing local users to gain privileges via unspecified vectors.
Multiple buffer overflows in lmgrd and Vendor Daemon in Flexera FlexNet Publisher before 11.13.1.2 Security Update 1 allow remote attackers to execute arbitrary code via a crafted packet with opcode 0x107 or 0x10a.
The ecc_256_modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation, leading to incorrect output in its implementation of the P-256 NIST elliptic curve.
In Nettle versions before 3.2, the x86_64/ecc-384-modp.asm file does not properly handle carry propagation, leading to incorrect output in its implementation of the P-384 NIST elliptic curve.
The ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation, leading to incorrect output in its implementation of the P-256 NIST elliptic curve.
Google Chrome before 48.0.2564.116 allows remote attackers to bypass the Blink Same Origin Policy and a sandbox protection mechanism via unspecified vectors.
The Data Protection component in the VMware vSphere GUI in IBM Tivoli Storage Manager for Virtual Environments before version 6.3.2.5, 6.4.3.1, and 7.1.4, as well as Tivoli Storage FlashCopy Manager for VMware before version 3.1.1.3, 3.2.0.6, and 4.1.4, allows remote attackers to obtain administrative privileges via a crafted URL that triggers back-end function execution.
The web interface on Advantech/B+B SmartWorx VESP211-EU devices with firmware 1.7.2 and VESP211-232 devices with firmware 1.5.1 and 1.7.2 relies on the client to implement access control, allowing remote attackers to perform administrative actions via modified JavaScript code.
SQL injection vulnerability in the Help plug-in 1.3.5 and earlier in Cuore EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote authenticated users to execute arbitrary OS commands by leveraging console administrator access.
Zhuhai RaySharp firmware has a hardcoded root password, which makes it easier for remote attackers to obtain access via a session on TCP port 23 or 9000.
The cliserver implementation in Dell SonicWALL GMS, Analyzer, and UMA EM5000 versions 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote attackers to deserialize and execute arbitrary Java code via crafted XML data.
The GMS ViewPoint web application in Dell SonicWALL GMS, Analyzer, and UMA EM5000 versions 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote authenticated users to execute arbitrary commands via configuration input.
Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway versions 11.x before 11.0 Build 64.34, 10.5 before 10.5 Build 59.13, and 10.5.e before Build 59.1305.e allow remote attackers to gain privileges via unspecified NS Web GUI commands.