CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple untrusted search path vulnerabilities in cURL and libcurl before version 7.49.1 allow local users to execute arbitrary code and conduct DLL hijacking attacks when SSPI or telnet is enabled.
Cisco AsyncOS 9.7.0-125 on Email Security Appliance (ESA) devices allows remote attackers to bypass intended spam filtering via crafted executable content in a ZIP archive.
The GTPv1 implementation on Cisco ASR 5000 devices before version 19.4 is vulnerable to remote attacks that can lead to denial of service by restarting the Session Manager process. Attackers can exploit a crafted GTPv1 packet.
Cisco 8800 phones with software 11.0(1) do not properly enforce mounted-filesystem permissions, allowing local users to write to arbitrary files by leveraging shell access.
Cisco IOS 15.5(3)M on Integrated Services Router (ISR) 800, 819, and 829 devices allows remote attackers to cause a denial of service (memory consumption) via crafted TCP packets on the SSH port.
The Chrome HUDweb plugin before 2016-05-05 for Fonality (previously trixbox Pro) versions 12.6 through 14.1i uses the same hardcoded private key across different customers' installations. This allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation.
Fonality (previously trixbox Pro) versions 12.6 through 14.1i before 2016-06-01 uses weak permissions for the /var/www/rpc/surun script, allowing local users to obtain root access for unspecified command execution by leveraging access to the nobody account.
The password-recovery feature on NETGEAR D3600 and D6000 devices with specific firmware versions allows remote attackers to discover the cleartext administrator password by reading the HTML source code.
Moxa PT-7728 devices with software 3.4 build 15081113 allow remote authenticated users to change the configuration via vectors involving a local proxy.
The NVIDIA Graphics Drivers subsystem in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
EMC Data Domain OS versions 5.4 through 5.7 before 5.7.2.0 have a default no_root_squash option for NFS exports, making it easier for remote attackers to obtain filesystem access by leveraging client root privileges.
IBM General Parallel File System (GPFS) in versions 2.0.0 through 2.0.7 and 2.5.x through 2.5.5, 3.x before 3.5.5, and 4.x before 4.0.3, allows local users to gain privileges via a crafted parameter to a setuid program.
CVE-2016-1195 describes an open redirect vulnerability in Cybozu Garoon 3.x and 4.x before version 4.2.1 that allows remote attackers to redirect users to arbitrary websites.
The CSRF vulnerability in I-O DATA DEVICE ETX-R devices allows remote attackers to hijack the authentication of arbitrary users.
In H2O before version 1.7.3 and 2.x before 2.0.0-beta5, there is a flaw in handling HTTP/2 disconnection, which can lead to denial of service (use-after-free and application crash) or potentially allow arbitrary code execution via a crafted packet.
Directory traversal vulnerability on BUFFALO WZR-600DHP3 and WZR-S600DHP devices with firmware 2.16 and earlier allows remote attackers to read arbitrary files via unspecified vectors.
Directory traversal vulnerability in kml2jsonp.php in Old_GSI_Maps before January 2015 on Windows allows remote attackers to read arbitrary files via unspecified vectors.
NetCommons version 2.4.2.1 and earlier allows remote authenticated secretariat (aka CLERK) users to gain privileges by creating a SYSTEM_ADMIN account.
HPE Service Manager software versions 9.30 to 9.41 allow remote authenticated users to obtain sensitive information, modify data, and conduct server-side request forgery (SSRF) attacks via unspecified vectors, related to the Server, Web Client, Windows Client, and Service Request components.
The System Configuration Protocol (SCP) core messaging interface in Cisco Prime Network Registrar 8.2 before 8.2.3.1 and 8.3 before 8.3.2 allows remote attackers to obtain sensitive information via crafted SCP messages.