CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An issue was discovered in Moxa EDR-810 Industrial Secure Router that allows a malicious user to access configuration and log files by accessing a specific URL on the web server.
An issue was discovered in Siemens ETA4 firmware (all versions prior to Revision 08) of the SM-2558 extension module. Specially crafted packets sent to Port 2404/TCP could cause the affected device to go into defect mode.
An issue was discovered on Schneider Electric IONXXXX series power meters regarding the lack of CSRF Token generation to authenticate the user during a session. Successful exploitation of this vulnerability can allow unauthorized configuration changes to be made and saved.
Multiple instances of heap-based buffer overflows were discovered in Delta Electronics WPLSoft, ISPSoft, and PMSoft, which may allow the execution of arbitrary code or denial of service.
An issue was discovered in CA Unified Infrastructure Management Version 8.47 and earlier related to improper handling of external input for pathname construction. The software does not properly neutralize sequences like '..', which can lead to access outside of the restricted directory.
An issue was discovered in Delta Electronics WPLSoft, ISPSoft, and PMSoft related to multiple instances of out-of-bounds write conditions. This may allow malicious files to be read and executed by the affected software.
An issue was discovered in OmniMetrix OmniView, Version 1.2 related to insufficient password requirements. This may allow an attacker to gain access to the web application by brute forcing account passwords.
An issue was discovered in Fatek Automation PM Designer V3 Version 2.1.2.2 and Automation FV Designer Version 1.2.8.0, allowing an attacker to trigger a stack-based buffer overflow by sending additional valid packets. This could lead to a crash and also allows for remote buffer overflow on the Fatek Communication Server.
An issue was discovered in Fatek Automation PM Designer V3 Version 2.1.2.2, and Automation FV Designer Version 1.2.8.0, allowing an attacker to send additional valid packets. This could lead to a crash or execution of arbitrary code due to improper restriction of operations within the bounds of a memory buffer.
An issue was discovered in the OmniView web application, version 1.2, related to the transmission of credentials using the HTTP protocol. This could allow an attacker to sniff these credentials, leading to account compromise.
An issue was discovered in Locus Energy LGate prior to version 1.05H related to improper validation of data in the PHP script managing energy meter parameters. This affects models LGate 50, LGate 100, LGate 101, LGate 120, and LGate 320.
An issue was discovered in Sauter NovaWeb web HMI related to a protection mechanism that relies on the existence or values of a cookie. However, it does not properly ensure that the cookie is valid for the associated user.
Bubblewrap before 0.1.3 sets the PR_SET_DUMPABLE flag, which might allow local users to gain privileges by attaching to the process, as demonstrated by sending commands to a PrivSep socket.
Funkcja rsa_verify_hash_ex w bibliotece LibTomCrypt, używana w OP-TEE przed wersją 2.2.0, nie weryfikuje, czy długość wiadomości jest równa długości danych zakodowanych w ASN.1. To umożliwia zdalnym atakującym fałszowanie podpisów RSA lub certyfikatów publicznych za pomocą ataku na fałszowanie podpisów Bleichenbachera.
Samsung devices with Android KK (4.4), L (5.0/5.1), or M (6.0) allow attackers to cause a denial of service (system crash) via a crafted system call to TvoutService_C.
Versions of Crypto++ (cryptopp) before 5.6.4 have a timing attack protection issue in the Rijndael::Enc::ProcessAndXorBlock and Rijndael::Dec::ProcessAndXorBlock functions. Compiler optimization may allow attackers to conduct timing attacks.
The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file.
In version 3.20161219 of ikiwiki, there is an issue with improper checking of access permission changes for pages when the git and recentchanges plugins and CGI interface are enabled. This allows remote attackers to revert certain changes by leveraging permissions to modify the page before the revision was made.
CVE-2016-8495 describes an improper certificate validation vulnerability in Fortinet FortiManager versions 5.0.6 through 5.2.7 and 5.4.0 through 5.4.1. This allows a remote attacker to spoof a trusted entity using a man-in-the-middle (MITM) attack via the Fortisandbox devices probing feature.
A crash in libmysqlclient.so occurs in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5, as well as in MariaDB through 5.5.54, 10.0.x through 10.0.29, 10.1.x through 10.1.21, and 10.2.x through 10.2.3.