CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Cisco IP Phone 8800 devices with software 11.0(1) are vulnerable to remote attacks that can lead to denial of service through memory corruption via a crafted HTTP request.
The Self-Service Portal in EMC RSA Authentication Manager (AM) Prime Self-Service versions 3.0 and 3.1 before 3.1 1915.42871 allows remote authenticated users to cause a denial of service (PIN change for an arbitrary user) via a modified token serial number within a PIN change request.
The default configuration of the IPsec IKE peer listener in F5 BIG-IP LTM and other components before specified versions allows remote attackers to establish IKE Phase 1 negotiations. This may lead to brute-force attacks against Phase 2 negotiations.
The Organization and Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote authenticated users to bypass organization and location restrictions, enabling (a) reading, (b) editing, or (c) deleting arbitrary organizations or locations.
Multiple incomplete blacklist vulnerabilities in Apache Sentry before 1.7.0 allow remote authenticated users to execute arbitrary code via the Hive builtin functions: reflect, reflect2, or java_method.
The Configuration utility in F5 BIG-IP LTM, APM, ASM, and other versions before 11.2.1 HF16, 11.4.1 HF10, 11.5.4, and 11.6.1 allows remote authenticated users with certain permissions to gain privileges by leveraging an Access Policy Manager customization configuration section that allows file uploads.
IOMobileFrameBuffer in Apple iOS before 9.3.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
The web-based GUI in Cisco Firepower Management Center and Cisco ASA software allows remote authenticated users to escalate user account privileges via crafted HTTP requests.
The web-based GUI in Cisco Firepower Management Center 4.x and 5.x before 5.3.1.2 and 5.4.x before 5.4.0.1, as well as in Cisco Adaptive Security Appliance (ASA) Software on 5500-X devices with FirePOWER Services 4.x and 5.x before 5.3.1.2 and 5.4.x before 5.4.0.1, allows remote authenticated users to execute arbitrary commands as root via crafted HTTP requests.
The Grapevine update process in Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) 1.0 allows remote authenticated users to execute arbitrary commands as root via a crafted upgrade parameter.
Oprogramowanie Cisco Adaptive Security Appliance (ASA) przed wersją 8.4(1) na urządzeniach ASA 5500, ASA 5500-X, PIX i FWSM umożliwia lokalnym użytkownikom uzyskanie uprawnień poprzez nieprawidłowe polecenia CLI. Jest to związane z błędem o identyfikatorze CSCtu74257, znanym również jako EPICBANANA.
Przepełnienie bufora w oprogramowaniu Cisco Adaptive Security Appliance (ASA) do wersji 9.4.2.3 na urządzeniach ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX i FWSM umożliwia zdalnym uwierzytelnionym użytkownikom wykonanie dowolnego kodu za pomocą spreparowanych pakietów SNMP IPv4.
Fontconfig before 2.12.1 does not validate offsets, allowing local users to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file.
A vulnerability in Sophos EAS Proxy before version 6.2.0 allows remote attackers to access arbitrary web resources from the backend mail system when Lotus Traveler is enabled, known as an Open Reverse Proxy vulnerability.
Use-after-free vulnerability in libcurl before version 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors.
Versions of curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which may allow remote attackers to hijack the authentication of the connection.
curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, allowing remote attackers to bypass intended restrictions by resuming a session.
Microsoft Internet Explorer 11 and Edge allow remote attackers to execute arbitrary code via a crafted web page, known as 'Microsoft Browser Memory Corruption Vulnerability.'
The PDF library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold and 1511, and Microsoft Edge allows remote attackers to execute arbitrary code via a crafted PDF file.
Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 contain a vulnerability that allows remote attackers to execute arbitrary code via a crafted file, known as 'Graphics Component Memory Corruption Vulnerability.'