CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Comcast firmware on Cisco DPC3939 devices allows remote attackers to compute password-of-the-day values via unspecified vectors.
The Comcast firmware on Cisco DPC3939 devices allows remote attackers to write arbitrary data to a known /var/tmp/sess_* pathname by leveraging the device's operation in UI dev mode.
The Comcast firmware on Cisco DPC3939 devices allows remote attackers to discover a CM MAC address by sniffing Wi-Fi traffic and performing simple arithmetic calculations.
The Comcast firmware on Cisco DPC3939 devices allows remote attackers to obtain unintended access to the 169.254/16 IP network by adding a routing-table entry that specifies the LAN IP address as the router for that network.
The Comcast firmware on Cisco DPC3939 devices sets the CM MAC address with a two-byte offset from the MTA/VoIP MAC address, allowing remote attackers to discover hidden Home Security Wi-Fi networks.
In Earcms Ear Music through version 4.1 build 20170710, remote authenticated users can execute arbitrary PHP code by changing the allowable music-upload extensions to include .php in addition to .mp3 and .m4a in admin.php?iframe=config_upload, and then using user.php/music/add/ to upload the code.
The function 'Token& Scanner::peek' in yaml-cpp version 0.5.3 and earlier allows remote attackers to cause a denial of service via a '!2' string.
InternetSoft FTP Commander version 8.02 and prior has an untrusted search path, allowing DLL hijacking via a malicious dwmapi.dll file.
VIT Spider Player version 2.5.3 has an untrusted search path, allowing DLL hijacking via a Trojan horse dwmapi.dll, olepro32.dll, dsound.dll, or AUDIOSES.dll file.
Tenshi 0.15 creates a tenshi.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by modifying tenshi.pid before a root script executes a 'kill `cat /pathname/tenshi.pid`' command.
The writeRandomBytes_RtlGenRandom function in xmlparse.c in libexpat versions 2.2.1 and 2.2.2 on Windows allows local users to gain privileges via a Trojan horse ADVAPI32.DLL in the current working directory due to an untrusted search path, known as DLL hijacking.
Version 4.2.18 of BigTree contains an SQL injection vulnerability in process.php, allowing remote authenticated users to execute arbitrary SQL commands via the tags array parameter.
In Xinha 0.96, used in Jojo 4.4.0, there is a directory traversal vulnerability in plugins/ImageManager/backend.php that allows remote attackers to delete any folder via directory traversal sequences in the deld parameter.
The NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer handler where a NULL pointer dereference may lead to denial of service or potential escalation of privileges.
The NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a value passed from a user to the driver is not correctly validated and used as the index to an array.
The NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where improper input parameter handling may lead to denial of service or potential escalation of privileges.
The NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a pointer passed from a user to the driver is used without validation.
The NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where the size of an input buffer is not validated. This may lead to denial of service or potential escalation of privileges.
The NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler where a NULL pointer dereference may lead to a denial of service or potential escalation of privileges.
The NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler where a missing permissions check may allow users to gain access to arbitrary physical system memory, which may lead to an escalation of privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS