CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Podatność na wstrzykiwanie SQL w serwerze UDDI w SAP NetWeaver J2EE Engine 7.40 umożliwia zdalnym atakującym wykonywanie dowolnych poleceń SQL poprzez nieokreślone wektory. Jest to związane z notą bezpieczeństwa SAP 2101079.
A use-after-free vulnerability in the resolver in nginx versions 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or possibly have unspecified other impact via a crafted DNS response related to CNAME response processing.
The Windows-based Host Interface Program (WHIP) service on Huawei SmartAX MT882 devices V200R002B022 Arg relies on the client to send a length field that is consistent with a buffer size. This allows remote attackers to cause a denial of service (device outage) or possibly have unspecified other impact via crafted traffic on TCP port 8701.
Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 version 1.5.0.11 and earlier allow remote attackers to execute arbitrary Java code by uploading a JSP file.
HP Continuous Delivery Automation (CDA) version 1.30 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
Buffer overflow in the IKEv1 and IKEv2 implementations in Cisco ASA Software before versions 8.4(7.30), 8.7 before 8.7(1.18), 9.0 before 9.0(4.38), and others allows remote attackers to execute arbitrary code or cause a denial of service via crafted UDP packets.
Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Photoshop CC 2014 before version 15.2.4, Photoshop CC 2015 before version 16.1.2, and Bridge CC before version 6.2 have a vulnerability that allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Connect before version 9.5.2 allows remote attackers to have an unspecified impact via a crafted parameter in a URL.
Multiple unspecified services in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 do not require authentication, allowing remote attackers to obtain sensitive information, modify settings, or manage build agents.
An unspecified vulnerability in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows remote attackers to execute arbitrary Java code via serialized data to the JMS port.
Apache CloudStack before version 4.5.2 does not properly preserve VNC passwords when migrating KVM virtual machines, allowing remote attackers to gain access by connecting to the VNC server.
The Smack XMPP API in Ignite Realtime, used in Atlassian Bamboo before version 5.9.9 and 5.10.x before 5.10.0, allows remote configured XMPP servers to execute arbitrary Java code via serialized data in an XMPP message.
OpenELEC and RasPlex devices have a hardcoded password for the root account, making it easier for remote attackers to gain access via an SSH session.
The nf_nat_redirect_ipv4 function in the Linux kernel before version 4.4 allows remote attackers to cause a denial of service through a NULL pointer dereference, leading to system crashes. This issue is related to CVE-2003-1604.
The NuPlayer::GenericSource::notifyPreparedAndCleanup function in mediaserver in Android 5.x before version 5.1.1 LMY49G and 6.x before 2016-02-01 improperly manages mDrmManagerClient objects. This allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.
libstagefright in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 has a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file. This issue affects the SoftMPEG4Encoder and SoftVPXEncoder components.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted wireless control message packets.
The Sauter EY-WS505F0x0 module before version 1.6.0 sends cleartext credentials, allowing remote attackers to obtain sensitive information by sniffing the network.