CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A buffer overflow vulnerability was found in Tenda AC9 routers versions V1.0 through V15.03.05.19(6318) and AC9 V3.0 V15.03.06.42_multi. Attackers can exploit the 'index' parameter to execute arbitrary code.
A buffer overflow vulnerability was found in Tenda AC9 routers versions V1.0 through V15.03.05.19(6318) and AC9 V3.0 V15.03.06.42_multi. Attackers can exploit the 'urls' parameter to execute arbitrary code on the device.
IrfanView 4.54 contains a vulnerability that allows an attacker to cause a denial of service or possibly other unspecified impacts via a crafted XBM file. The issue is related to data from a faulting address being used as arguments in a function call in FORMATS!ReadMosaic.
A vulnerability in the web services interface of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to trigger a DoS condition. It is due to improper input validation when parsing HTTPS requests. An attacker can send a malicious HTTPS request to cause the device to reload, resulting in DoS.
A vulnerability in the SSL/TLS message handler of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS). The issue is due to improper processing of incoming SSL/TLS packets. Exploitation involves sending a crafted SSL/TLS packet.
A vulnerability in Snort rules in multiple Cisco products could allow an unauthenticated, remote attacker to cause a denial of service (DoS). The issue is due to improper handling of Block with Reset or Interactive Block with Reset actions if a rule is configured without proper constraints. Exploitation involves sending a crafted IP packet.
A vulnerability in the TCP Normalizer of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software operating in transparent mode could allow an unauthenticated, remote attacker to poison MAC address tables, resulting in a denial of service (DoS) vulnerability. The issue is due to incorrect handling of certain TCP segments in transparent mode. Sending a crafted TCP segment can poison MAC tables in adjacent devices, causing network disruption.
A vulnerability in the memory management of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS). The issue is due to improper resource management when connection rates are high. Exploitation involves opening a significant number of connections.
A vulnerability in the software-based SSL/TLS message handler of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to reload the device, causing a denial of service (DoS). The issue is due to insufficient validation of SSL/TLS messages during software-based decryption. Exploitation involves sending a crafted SSL/TLS message.
A vulnerability in SSH connection processing for multi-instance deployments of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a DoS condition. It is due to improper error handling when an SSH session fails. An attacker can send a high rate of crafted SSH connections, leading to resource exhaustion and DoS; manual reload is required.
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to perform a directory traversal attack. The attacker would require valid device credentials. The issue is due to insufficient input validation of the HTTPS URL.
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS 14.7.1 and iPadOS 14.7.1, watchOS 7.6.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.
An issue was discovered in the scanallsubs function in src/sbbs3/scansubs.cpp in Synchronet BBS, which may allow attackers to view sensitive information due to an uninitialized value.
A SQL injection vulnerability has been discovered in zz cms version 2019 in the subzs.php component. It allows attackers to retrieve sensitive data from the database.
A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
Win32k Elevation of Privilege Vulnerability. Technical details are not provided in the description, but it is a vulnerability allowing privilege escalation.
Win32k Elevation of Privilege Vulnerability. Technical details are not provided in the description, but it is a vulnerability allowing privilege escalation.
Win32k Elevation of Privilege Vulnerability. Technical details are not provided in the description, but it is a vulnerability allowing privilege escalation.
An issue was discovered in aspeed_lpc_ctrl_mmap in the Linux kernel before 5.14.6. Local attackers with access to the Aspeed LPC control interface could overwrite kernel memory and potentially execute privileges. This occurs because a certain comparison uses values that are not memory sizes.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS