CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Eye of GNOME (eog) versions 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib before 2.44.1, allow remote attackers to cause a denial of service via invalid UTF-8 passed to GMarkup.
RESTEasy enables GZIPInterceptor, allowing remote attackers to cause a denial of service via unspecified vectors.
A vulnerability has been identified in the EN100 Ethernet module affecting various firmware variants. Attackers with access to the device's web interface may bypass authentication and perform certain administrative operations.
A vulnerability has been identified in the EN100 Ethernet module affecting various firmware variants. Versions below specified numbers may be susceptible to an attack that causes the device to enter defect mode upon receiving specially crafted packets on port 80/tcp.
Media Origination System Suite Software 2.6 and earlier in Cisco Virtual Media Packager (VMP) allows remote attackers to bypass authentication and make arbitrary Platform and Applications Manager (PAM) API calls via unspecified vectors.
Cisco WebEx Meetings Player T29.10, when WRF file support is enabled, allows remote attackers to execute arbitrary code via a crafted file.
A cross-site request forgery (CSRF) vulnerability in the admin web interface in GNU Mailman before version 2.1.15 allows remote attackers to hijack the authentication of administrators.
CVE-2016-6893 is a CSRF vulnerability in the user options page in GNU Mailman 2.1.x before version 2.1.23, allowing remote attackers to hijack the authentication of arbitrary users for requests that modify an option.
MQCLI on IBM MQ Appliance M2000 and M2001 devices allows local users to execute arbitrary shell commands via a crafted (1) Disaster Recovery or (2) High Availability command.
The media-file upload feature in vBulletin before certain versions allows remote attackers to conduct SSRF attacks via a crafted URL, resulting in a Redirection HTTP status code.
AKABEi SOFT2 games allow remote attackers to execute arbitrary OS commands via crafted saved data, as demonstrated by Happy Wardrobe.
The web-based management interface on Cisco Small Business 220 devices with firmware before 1.0.1.1 is vulnerable to remote attacks that can lead to denial of service via a crafted HTTP request.
CVE-2016-1470 describes a Cross-site request forgery (CSRF) vulnerability in the web-based management interface on Cisco Small Business 220 devices with firmware before version 1.0.1.1. This allows remote attackers to hijack the authentication of arbitrary users.
The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via a crafted OOXML spreadsheet containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Szyfry DES i Triple DES, używane w protokołach TLS, SSH i IPSec, mają ograniczenie urodzinowe wynoszące około czterech miliardów bloków. Umożliwia to zdalnym atakującym uzyskanie danych w postaci niezaszyfrowanej za pomocą ataku urodzinowego na długotrwałą sesję szyfrowaną, znanego jako atak 'Sweet32'.
A stack-based buffer overflow exists in NUUO NVRmini 2 versions 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance version 1.1.2 in cgi-bin/cgi_main. This allows remote authenticated users to execute arbitrary code via the sn parameter to the transfer_license command.
In NUUO NVRmini 2 versions 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance version 1.1.2, remote authenticated users can execute arbitrary commands via shell metacharacters in the sn parameter to the transfer_license command.
NUUO NVRmini 2 versions 1.7.5 through 3.0.0, NUUO NVRsolo versions 1.0.0 through 3.0.0, and NETGEAR ReadyNAS Surveillance versions 1.1.1 through 1.4.1 have a hardcoded password qwe23622260 for the nuuoeng account, allowing remote attackers to obtain sensitive information via an __nvr_status___.php request.
In NUUO NVRmini 2 versions 1.7.5 through 2.x, NUUO NVRsolo versions 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance versions 1.1.1 through 1.4.1, a vulnerability allows remote attackers to reset the administrator password via a cmd=loaddefconfig action.
VMware Identity Manager 2.x before 2.7 and vRealize Automation 7.0.x before 7.1 allow local users to obtain root access via unspecified vectors.