CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Openshift allows remote attackers to gain privileges by updating a build configuration that was created with an allowed type to a type that is not allowed.
The filesystem storage backend in Radicale before version 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path.
The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name.
The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
The MoofParser::Metadata function in libstagefright in Mozilla Firefox before version 44.0 does not limit the size of read operations, which may allow remote attackers to cause a denial of service (integer overflow and buffer overflow) or possibly have unspecified other impact via crafted metadata.
The Buffer11::NativeBuffer11::map function in ANGLE, as used in Mozilla Firefox before version 44.0, might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before version 44.0 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to uninitialized memory encountered during brotli data compression, and other vectors.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 44.0 and Firefox ESR 38.x before 38.6 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.
HPE Operations Manager versions 8.x and 9.0 on Windows allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
Westermo WeOS before version 4.19.0 uses the same SSL private key across different customers' installations, making it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a key.
McPvDrv.sys version 4.6.111.0 in McAfee File Lock 5.x and McAfee Total Protection allows local users to obtain sensitive information from kernel memory or cause a system crash via a large VERIFY_INFORMATION.Length value in an IOCTL_DISK_VERIFY ioctl call.
CVE-2015-8789 is a use-after-free vulnerability in the EbmlMaster::Read function in libEBML before version 1.3.3. It allows context-dependent attackers to have unspecified impact via a 'deeply nested element with infinite size' followed by another upper-level element in an EBML document.
A stack-based buffer overflow on Rockwell Automation Allen-Bradley MicroLogix 1100 devices A through 15.000 and B before 15.002 allows remote attackers to execute arbitrary code via a crafted web request.
CVE-2015-6319 is a vulnerability in the web-based management interface on Cisco RV220W devices that allows remote attackers to execute arbitrary SQL commands via a crafted header in an HTTP request.
A race condition in the initialization process on Lexmark printers with firmware ATL before ATL.02.049, CB before CB.02.049, PP before PP.02.049, and YK before YK.02.049 allows remote attackers to bypass authentication by leveraging incorrect detection of the security-jumper status.
Multiple unspecified vulnerabilities in Google V8 before version 4.8.271.17, as used in Google Chrome before version 48.0.2564.82, may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before January 20, 2016, has a hardcoded password for the 1MB@tMaN account. This makes it easier for remote attackers to gain access via an SSH or HTTP session.
The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before 2015-10-12 has a hardcoded password for the BlackWidow account, making it easier for remote attackers to gain access via SSH or HTTP sessions.
An unspecified CGI script in Cisco FX-OS before version 1.1.2 on Firepower 9000 devices and in Cisco UCS Manager before versions 2.2(4b), 2.2(5) before 2.2(5a), and 3.0 before 3.0(2e) allows remote attackers to execute arbitrary shell commands via a crafted HTTP request.
Cisco Modular Encoding Platform D9036 software before version 02.04.70 has hardcoded root and guest passwords, making it easier for remote attackers to gain access via an SSH session.