CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A heap-based buffer overflow exists in the wcnss_wlan_write function in the wcnss_wlan device driver for Linux kernel 3.x. Attackers can cause a denial of service or potentially unspecified other impacts by writing to /dev/wcnss_wlan with an unexpected amount of data.
ReadyDesk 9.1 allows local users to obtain cleartext SQL Server credentials by reading the SQL_Config.aspx file and decrypting data with a hardcoded key in the ReadyDesk.dll file.
Accellion Kiteworks appliances before kw2016.03.00 use setuid-root permissions for /opt/bin/cli, allowing local users to gain privileges via unspecified vectors.
Directory traversal vulnerability in chat/openattach.aspx in ReadyDesk 9.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the SESID parameter in conjunction with a filename in the FNAME parameter.
The components in HPE XP P9000 Command View Advanced Edition Software before version 8.4.1-00 and XP7 Command View Advanced Edition Suite before version 8.4.1-00 have a vulnerability that allows remote attackers to obtain sensitive information via unspecified vectors.
The web UI in Red Hat CloudForms 4.1 allows remote authenticated users to execute arbitrary code due to a lack of field filters.
Virtual servers in F5 BIG-IP systems in versions 11.2.1 HF11 through HF15, 11.4.1 HF4 through HF10, 11.5.3 through 11.5.4, 11.6.0 HF5 through HF7, and 12.0.0, when configured with a TCP profile, allow remote attackers to cause a denial of service via crafted network traffic.
Cisco AnyConnect Secure Mobility Client before 4.2.05015 and 4.3.x before 4.3.02039 mishandles pathnames, allowing local users to gain privileges via a crafted INF file.
UltraVNC Repeater before 1300 does not restrict destination IP addresses or TCP ports, allowing remote attackers to obtain open-proxy functionality by using a :: substring between the IP address and port number.
WebKit w systemie iOS firmy Apple przed wersją 9.3.5 pozwala zdalnym atakującym na wykonanie dowolnego kodu lub spowodowanie odmowy usługi (uszkodzenie pamięci) poprzez specjalnie przygotowaną stronę internetową.
Jądro systemu Apple iOS przed wersją 9.3.5 umożliwia atakującym wykonanie dowolnego kodu w kontekście z uprawnieniami lub spowodowanie odmowy usługi (uszkodzenie pamięci) za pomocą spreparowanej aplikacji.
CVE-2016-4069 in Roundcube Webmail before version 1.1.5 has a cross-site request forgery (CSRF) vulnerability that allows remote attackers to hijack user authentication for requests that download attachments. This can lead to denial of service through unspecified vectors.
WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifconfig command.
ZModo ZP-NE14-S and ZP-IBH-13W devices do not enforce a WPA2 configuration setting, allowing remote attackers to associate with an arbitrary access point using a recognized SSID value.
Urządzenia Rockwell Automation MicroLogix 1400 PLC mają wbudowaną, twardo zakodowaną społeczność SNMP, co ułatwia zdalnym atakującym ładowanie dowolnych aktualizacji oprogramowania. Wykorzystanie tej społeczności może prowadzić do nieautoryzowanych zmian w oprogramowaniu urządzenia.
The User Data Services (UDS) API implementation in Cisco Unified Communications Manager 11.5 allows remote attackers to bypass intended access restrictions and obtain sensitive information via unspecified API calls.
A memory leak in Cisco IOS XR versions 5.1.x through 5.1.3, 5.2.x through 5.2.5, and 5.3.x through 5.3.2 on ASR 9001 devices allows remote attackers to cause a denial of service (control-plane protocol outage) via crafted fragmented packets.
Cisco WebEx Meetings Server version 2.6 allows remote attackers to bypass intended access restrictions and obtain sensitive application information via unspecified vectors.
Cisco Aironet 1800, 2800, and 3800 devices with software before 8.2.110.0, 8.2.12x before 8.2.121.0, and 8.3.x before 8.3.102.0 allow local users to gain privileges via crafted CLI parameters.
HPE Smart Update in Storage Sizing Tool and other tools before specified versions allows remote attackers to execute arbitrary code via unspecified vectors.