CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An issue was discovered in certain Apple products affecting iOS before 11.1, Safari before 11.0.1, iCloud before 7.1 on Windows, iTunes before 12.7.1 on Windows, and tvOS before 11.1. The issue involves the 'WebKit' component and allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.
An issue was discovered in certain Apple products related to the 'WebKit' component. Affects iOS before 11.1, Safari before 11.0.1, iCloud before 7.1 on Windows, iTunes before 12.7.1 on Windows, and tvOS before 11.1.
An issue was discovered in certain Apple products affecting iOS before 11.1, Safari before 11.0.1, iCloud before 7.1 on Windows, iTunes before 12.7.1 on Windows, and tvOS before 11.1. The issue involves the 'WebKit' component and allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.
An issue was discovered in certain Apple products affecting iOS before 11.1, Safari before 11.0.1, iCloud before 7.1 on Windows, iTunes before 12.7.1 on Windows, and tvOS before 11.1. The issue involves the 'WebKit' component and allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website.
An issue was discovered in certain Apple products affecting iOS before 11.1, Safari before 11.0.1, iCloud before 7.1 on Windows, iTunes before 12.7.1 on Windows, and tvOS before 11.1. The issue involves the 'WebKit' component and allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.
An issue was discovered in certain Apple products affecting iOS before 11.1, Safari before 11.0.1, iCloud before 7.1 on Windows, iTunes before 12.7.1 on Windows, and tvOS before 11.1. The issue involves the 'WebKit' component and allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.
An issue was discovered in certain Apple products affecting iOS before 11.1, Safari before 11.0.1, iCloud before 7.1 on Windows, iTunes before 12.7.1 on Windows, and tvOS before 11.1. The issue involves the 'WebKit' component, allowing remote attackers to execute arbitrary code or cause a denial of service via a crafted website.
An issue was discovered in certain Apple products affecting iOS before 11.1, Safari before 11.0.1, iCloud before 7.1 on Windows, iTunes before 12.7.1 on Windows, and tvOS before 11.1. The issue involves the 'WebKit' component and allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.
An issue was discovered in certain Apple products affecting iOS before 11.1, Safari before 11.0.1, iCloud before 7.1 on Windows, iTunes before 12.7.1 on Windows, and tvOS before 11.1. The issue involves the 'WebKit' component and allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.
An issue was discovered in certain Apple products related to the 'WebKit' component. Affects iOS before 11.1, Safari before 11.0.1, iCloud before 7.1 on Windows, iTunes before 12.7.1 on Windows, and tvOS before 11.1.
In SWFTools version 0.9.2, the png_load function in lib/png.c does not properly validate the multiplication of width and height values, which can lead to integer overflow, heap-based buffer overflow, and application crash.
In SWFTools 0.9.2, the png_load function in lib/png.c does not check the return value of a realloc call, which allows remote attackers to cause a denial of service (invalid write and application crash) or possibly have unspecified other impact via vectors involving an IDAT tag in a crafted PNG file.
The wav_convert2mono function in SWFTools 0.9.2 does not properly validate WAV data, which may lead to denial of service or other unspecified impacts via a crafted file.
In Inedo BuildMaster versions before 5.8.2, there are insufficient restrictions on the creation of RequireManageAllPrivileges event listeners.
Sanic versions before 0.5.1 allow reading arbitrary files through directory traversal, as demonstrated by the /static/..%2f substring.
Savitech driver packages for Windows silently install a self-signed certificate into the Trusted Root Certification Authorities store, which may lead to unauthorized access to the system.
The Debut embedded http server contains a remotely exploitable denial of service vulnerability that can be triggered by a single malformed HTTP POST request. The server hangs and eventually replies after approximately 300 seconds with an HTTP 500 error.
Buffer overflow in the ViewerCtrlLib.ViewerCtrl ActiveX control in Avaya IP Office Contact Center before version 10.1.1 allows remote attackers to cause a denial of service (heap corruption and crash) or execute arbitrary code via a long string to the open method.
Hola VPN version 1.34 has weak permissions (Everyone:F) under %PROGRAMFILES%, allowing local users to gain privileges via a Trojan horse 7za.exe or hola.exe file.
Roundcube Webmail w wersjach przed 1.1.10, 1.2.x przed 1.2.7 oraz 1.3.x przed 1.3.3 umożliwia nieautoryzowany dostęp do dowolnych plików na systemie plików hosta, w tym plików konfiguracyjnych. Wykorzystanie tej podatności miało miejsce w listopadzie 2017 roku.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS