CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Possible use after free due to improper handling of memory mapping of multiple processes simultaneously in Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, and Wearables.
A flaw was found in the Linux kernel before version 5.12. The value of internal.ndata in the KVM API is mapped to an array index, which can be updated by a user process at any time, leading to an out-of-bounds write. The highest threat is to data integrity and system availability.
The Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required.
A vulnerability in Windscribe VPN for Mac and Windows versions up to 2.02.10 allows local privilege escalation via the WindscribeService component. A low-privileged user can exploit OpenVPN options to execute code as root/SYSTEM.
CODESYS Gateway w wersjach przed 3.5.16.70 zawiera błąd dereferencji wskaźnika NULL, który może prowadzić do awarii usługi (DoS).
Multiple vulnerabilities in Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. These are due to lack of proper input validation of HTTPS requests. An attacker could exploit these by sending a crafted HTTPS request to an affected device. This affects only specific AnyConnect and WebVPN configurations.
A vulnerability in the SIP inspection engine of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a crash and reload of an affected device, resulting in DoS. The issue is a crash during a hash lookup for a SIP pinhole connection. An attacker can send crafted SIP traffic to trigger the crash and reload.
A vulnerability in the web services interface of Cisco ASA and FTD Software could allow an authenticated, remote attacker to cause a buffer overflow on an affected system. This is due to insufficient boundary checks for specific data. An attacker could exploit this by sending a malicious HTTP request, potentially disclosing data fragments or causing a device reload and DoS.
A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges on the underlying operating system of an affected device running in multi-instance mode. This is due to insufficient validation of user-supplied command arguments. An attacker could exploit this by submitting crafted input, leading to root command execution.
Multiple vulnerabilities in Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. These are due to lack of proper input validation of HTTPS requests. An attacker could exploit these by sending a crafted HTTPS request to an affected device. This affects only specific AnyConnect and WebVPN configurations.
A vulnerability in the software-based SSL/TLS message handler of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a device reload, causing a denial of service (DoS). The issue is due to insufficient validation of SSL/TLS messages during software-based decryption. Exploitation involves sending a crafted SSL/TLS message through the device.
Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
In MISP 2.4.141 in app/Model/MispObject.php, an incorrect sharing group association could lead to information disclosure on an event edit. Instead of using the sharing group object, the passed local ID is reused.
In Oracle HRMS (France) product of Oracle E-Business Suite (component: French HR) versions 12.1.1-12.1.3, an easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to compromise the system, leading to unauthorized creation, deletion, or modification of critical data and full access to all accessible data.
AdTran Personal Phone Manager 10.8.1 software is vulnerable to data exfiltration over DNS. Exposed web servers can be used as DNS redirectors to tunnel arbitrary data.
In the f2fs module of the Linux kernel (fs/f2fs/node.c) before version 5.12.0-rc4, there is an out-of-bounds (OOB) memory access flaw due to a bounds check failure. A local attacker can access out-of-bounds memory, leading to a system crash or leak of internal kernel information.
GStreamer przed wersją 1.18.4 może powodować uszkodzenie sterty podczas analizowania niektórych źle sformatowanych plików Matroska.
GStreamer przed wersją 1.18.4 może uzyskiwać dostęp do już zwolnionej pamięci w ścieżkach kodu błędów podczas demuksowania niepoprawnie sformatowanych plików Matroska.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS