CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in the SSL/TLS handler of Cisco Firepower Threat Defense (FTD) Software on Firepower 1000 Series could allow an unauthenticated, remote attacker to trigger a DoS condition. The issue is due to a communication error between internal functions. An attacker could send a crafted SSL/TLS message, causing a buffer underrun and device crash, leading to reload.
A vulnerability in the web services interface of Cisco ASA and FTD Software allows an unauthenticated, remote attacker to retrieve memory contents, potentially leading to disclosure of confidential information. The issue is due to a buffer tracking issue when parsing invalid URLs. A successful exploit could allow memory contents retrieval, leading to information disclosure.
A vulnerability in the packet processing functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. It is due to inefficient memory management. An attacker could exploit this by sending a high rate of IPv4 or IPv6 traffic through the device, which must match a configured block action in an access control policy.
Multiple vulnerabilities in the MGCP inspection feature of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerabilities are due to inefficient memory management.
A vulnerability in the SSL/TLS handler of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to exhaust memory resources on the affected device, leading to a DoS condition. The issue is due to improper resource management for inbound SSL/TLS connections. An attacker could exploit this by establishing multiple SSL/TLS connections with specific conditions, potentially exhausting memory and causing the device to stop accepting new SSL/TLS connections. Manual intervention is required to recover.
A vulnerability in the OSPF implementation in Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a memory leak on an affected device. The issue is due to incorrect processing of certain OSPF packets.
A vulnerability in DNS over IPv6 packet processing for Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause the device to unexpectedly reload, resulting in a denial of service (DoS) condition. The issue is due to improper length validation of a field in an IPv6 DNS packet.
A vulnerability in the VPN System Logging functionality for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a memory leak that depletes system memory over time, leading to unexpected behaviors or device crashes. It is due to improper memory freeing for VPN logging events when sessions are created or deleted.
A vulnerability in the GRE tunnel decapsulation feature of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a DoS condition. The issue is due to a memory handling error when GRE over IPv6 traffic is processed. An attacker could send crafted GRE over IPv6 packets with IPv4 or IPv6 payload, causing device crash.
A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, DVPN, Firewall Authentication Pass-Through with Web-Redirect, and ZTP allows an unauthenticated attacker to perform local file inclusion (LFI) or path traversal. An attacker may inject commands into httpd.log, read world-readable files, or obtain J-Web session tokens. If J-Web is enabled, the attacker could gain the same access level as a logged-in administrator.
Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. Targeted attacks in the wild abusing this flaw are known.
Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. Targeted attacks in the wild abusing this flaw are known.
A CWE-319 vulnerability exists that allows sensitive information to be transmitted in cleartext between the software and Modicon M218, M241, M251, and M258 controllers.
An issue was discovered in Sonatype Nexus Repository Manager in versions 3.21.1 and 3.22.0. It is possible for a user with appropriate privileges to create, modify, and execute scripting tasks without use of the UI or API. NOTE: in 3.22.0, scripting is disabled by default (making this not exploitable).
An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'.
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format. For all systems except Windows 10, an attacker who successfully exploited the vulnerability could execute code remotely.
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'.
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format. For all systems except Windows 10, an attacker who successfully exploited the vulnerability could execute code remotely.
W aplikacji Zdalny pulpit dla systemu Mac występuje podatność na podniesienie uprawnień, która pozwala atakującemu na załadowanie niepodpisanych binarnych plików. Jest to znane jako 'Podatność na podniesienie uprawnień w aplikacji Microsoft Remote Desktop dla systemu Mac'.
Wtyczka Snap Creek Duplicator przed wersją 1.3.28 dla WordPressa (oraz Duplicator Pro przed wersją 3.8.7.1) umożliwia atak typu Directory Traversal poprzez wykorzystanie sekwencji ../ w parametrze pliku dla funkcji duplicator_download lub duplicator_init.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS