CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
iRZ RUH2 versions before 2b do not validate firmware patches, allowing remote authenticated users to modify data or cause a denial of service via unspecified vectors.
HPE Service Manager versions 9.30 to 9.41 allow remote attackers to obtain sensitive information via unspecified vectors, related to the Web Client, Service Request Catalog, and Mobility components.
The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in Cisco IOS XE, IOS XR, and NX-OS allows remote attackers to cause a denial of service via crafted ND messages.
Cisco UCS Invicta versions 4.3, 4.5, and 5.0.1 use the same hardcoded GnuPG encryption key across different customers' installations. This allows remote attackers to defeat cryptographic protection mechanisms by sniffing network traffic to an Autosupport server and leveraging knowledge of this key from another installation.
Cisco WebEx Meeting Center Original Release Base allows remote attackers to obtain sensitive information about username validity by (1) attending or (2) hosting a meeting.
Buffer overflow in the Wi-Fi driver in Huawei Mate 8 devices before versions NXT-AL10C00B182, NXT-CL00C92B182, NXT-DL00C17B182, and NXT-TL00C01B182 may allow attackers to cause a denial of service (crash) or potentially gain privileges via a crafted application.
Buffer overflow in the Wi-Fi driver in Huawei Mate 8 devices before versions NXT-AL10C00B182, NXT-CL00C92B182, NXT-DL00C17B182, and NXT-TL00C01B182 may allow attackers to cause a denial of service (crash) or gain privileges via a crafted application.
The administrative user interface in Pulse Connect Secure (PCS) versions 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote administrators to enumerate files, read arbitrary files, and conduct server side request forgery (SSRF) attacks via unspecified vectors.
Pulse Connect Secure (PCS) versions 8.2 before 8.2r1, 8.1 before 8.1r3, 8.0 before 8.0r11, and 7.4 before 7.4r13.4 allow remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
The read_binary function in buffer.c in pgpdump before version 0.30 allows context-dependent attackers to cause a denial of service through an infinite loop and CPU consumption by using crafted input.
An integer signedness error in the sockargs function in FreeBSD allows local users to cause a denial of service or gain privileges via a negative buflen argument, leading to a heap-based buffer overflow.
An integer signedness error in the genkbd_commonioctl function in FreeBSD allows local users to obtain sensitive information from kernel memory, cause a denial of service, or gain privileges via a negative value in the flen structure.
The S_reghop3, S_reghop4, and S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data.
Cisco IOS XR versions up to 5.3.2 mishandle Local Packet Transport Services (LPTS) flow-based entries, allowing remote attackers to cause a denial of service (session drop) by making many connection attempts to open TCP ports.
The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to bypass intended RBAC restrictions and obtain sensitive information, consequently gaining privileges.
Cisco TelePresence Video Communications Server (VCS) versions X8.x before X8.7.2 are vulnerable to denial of service (DoS) attacks via a crafted URI in a SIP header.
A memory leak in Cisco AsyncOS through version 8.8 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (memory consumption) via an unspecified HTTP status code.
Cisco AsyncOS before version 8.5.3-069 and in versions 8.6 through 8.8 on Web Security Appliance (WSA) devices mishandles memory allocation for HTTP requests, allowing remote attackers to cause a denial of service (proxy-process reload) via a crafted request.
A memory leak in Cisco AsyncOS 8.5 through 9.0 before 9.0.1-162 allows remote attackers to cause a denial of service via an HTTP file-range request for cached content.
Cisco AsyncOS 8.0 before version 8.0.6-119 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (proxy-process hang) via a crafted HTTP POST request.