CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.25)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in the SSL and TLS code of Cisco ASA Software could allow an unauthenticated, remote attacker to cause a reload of the affected system. The issue is due to improper parsing of crafted SSL or TLS packets.
A vulnerability in the DNS code of Cisco ASA Software could allow an unauthenticated, remote attacker to cause an affected device to reload or corrupt the information present in the device's local DNS cache. The vulnerability is due to a flaw in handling crafted DNS response messages.
Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow an unauthenticated, remote attacker to cause a buffer overflow condition or a reload of an affected device, leading to a denial of service (DoS) condition. These vulnerabilities are due to improper parsing of crafted EnergyWise packets destined to an affected device.
Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow an unauthenticated, remote attacker to cause a buffer overflow condition or a reload of an affected device, leading to a denial of service (DoS) condition. These vulnerabilities are due to improper parsing of crafted EnergyWise packets destined to an affected device.
Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow an unauthenticated, remote attacker to cause a buffer overflow condition or a reload of an affected device, leading to a denial of service (DoS) condition. These vulnerabilities are due to improper parsing of crafted EnergyWise packets destined to an affected device.
Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow an unauthenticated, remote attacker to cause a buffer overflow condition or a reload of an affected device, leading to a denial of service (DoS) condition. These vulnerabilities are due to improper parsing of crafted EnergyWise packets destined to an affected device.
A vulnerability in the Session Initiation Protocol (SIP) UDP throttling process of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient rate limiting protection.
A vulnerability in the detection engine parsing of Pragmatic General Multicast (PGM) protocol packets for Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition due to the Snort process unexpectedly restarting. The vulnerability is due to improper input validation of the fields in the PGM protocol packet.
IBM Security Guardium versions 8.2, 9.0, and 10.0 contain a vulnerability that could allow a local attacker with CLI access to inject arbitrary commands which would be executed as root.
The CSRF vulnerability in Red Hat JBoss BRMS and BPMS 6 allows remote attackers to hijack user authentication for requests that modify instances via a crafted web page.
There is a CSRF vulnerability in markposts.php in Moodle affecting versions 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, and 2.7 through 2.7.13 and earlier. It allows remote attackers to hijack user authentication to mark forum posts as read.
CVE-2016-1161 is a Cross-site request forgery (CSRF) vulnerability in ManageEngine Password Manager Pro before version 8.5 (Build 8500).
The webssx.sys driver in QuickHeal 16.00 allows remote attackers to cause a denial of service.
A Cross-Site Request Forgery issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. An attacker can forge a client request from a different site, allowing access to internal RDP systems on behalf of the currently logged in user.
W bibliotece ARM mbed TLS przed wersjami 1.3.19, 2.x przed 2.1.7 oraz 2.4.x przed 2.4.2 występuje podatność związana z niewłaściwym zwolnieniem wskaźnika stosu podczas analizy certyfikatów x509. Złośliwie skonstruowany certyfikat x509 może prowadzić do potencjalnego zdalnego wykonania kodu.
Twigmo bundled with CS-Cart 4.3.9 and earlier, and Twigmo bundled with CS-Cart Multi-Vendor 4.3.9 and earlier, allows remote authenticated users to execute arbitrary PHP code on the servers.
LINE for Windows before version 4.8.3 allows man-in-the-middle attackers to execute arbitrary code.
CVE-2016-1218 describes an SQL injection vulnerability in Cybozu Garoon before version 4.2.2.
MediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access restrictions by leveraging a call to the UserGetRights function after Session::getAllowedUserRights.
MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, allowing remote attackers to obtain sensitive information via a parse action to api.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS