CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The proxy-cache implementation in Cisco AsyncOS before version 8.0.7-151, 8.5.2-004, 8.7.0-171-LD, and 8.8.0-085 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service via multiple proxy connections.
A vulnerability in TYPE-MOON games, such as Fate/stay night and Fate/hollow ataraxia, allows remote attackers to execute arbitrary OS commands via crafted saved data.
A vulnerability in Cisco AsyncOS before versions 8.5.7-042, 9.x before 9.1.0-032, 9.1.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-042 on Email Security Appliance (ESA) devices allows remote attackers to cause a denial of service by flooding the device with TCP packets.
Cisco AsyncOS versions before 8.0.8-113, 8.1.x before 8.5.3-051, 8.6.x and 8.7.x before 8.7.0-171-LD, and 8.8.x before 8.8.0-085 on Web Security Appliance (WSA) devices allow remote attackers to cause a denial of service (memory consumption) via multiple file-range requests.
The vulnerability in Cisco AsyncOS before version 8.5.7-043 and 9.x before 9.1.1-023, as well as 9.5.x and 9.6.x before 9.6.0-046, involves mishandling malformed fields during email filtering. This allows remote attackers to cause a denial of service through a crafted attachment.
The CryptoKey interface implementation in Mozilla Firefox before version 42.0 and Firefox ESR 38.x before version 38.4 lacks status checking, which may allow attackers to have an unspecified impact via vectors related to a cryptographic key.
The AddWeightedPathSegLists and SVGPathSegListSMILType::Interpolate functions in Mozilla Firefox before version 42.0 and Firefox ESR 38.x before version 38.4 lack status checking, allowing remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted SVG document.
Buffer overflow in the rx::TextureStorage11 class in ANGLE, used in Mozilla Firefox before version 42.0 and Firefox ESR 38.x before version 38.4, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted texture data.
A buffer underflow in libjar in Mozilla Firefox before version 42.0 and Firefox ESR 38.x before version 38.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted ZIP archive.
Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 improperly follow the CORS cross-origin request algorithm for the POST method in situations involving an unspecified Content-Type header manipulation, allowing remote attackers to bypass the Same Origin Policy.
The accessibility-tools feature in Mozilla Firefox before version 42.0 on OS X improperly interacts with the implementation of the TABLE element, which may lead to application crashes or potentially allow remote attackers to execute arbitrary code.
Mozilla Firefox versions before 42.0 and Firefox ESR 38.x before 38.4 allow remote attackers to bypass the Same Origin Policy for an IP address origin, enabling cross-site scripting (XSS) attacks by appending whitespace characters to an IP address string.
Integer overflow in the PL_ARENA_ALLOCATE implementation in Netscape Portable Runtime (NSPR) in Mozilla Network Security Services (NSS) before version 3.19.2.1 and 3.20.x before version 3.20.1 allows remote attackers to execute arbitrary code or cause a denial of service via unspecified vectors.
The sec_asn1d_parse_leaf function in NSS before 3.19.2.1 and 3.20.x before 3.20.1 improperly restricts access to a data structure, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via crafted OCTET STRING data, related to a use-after-poison issue.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before version 42.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.
The Web Console in Commvault Edge Server 10 R2 allows remote attackers to execute arbitrary OS commands via crafted serialized data in a cookie.
The default configuration of the server in MobaXterm before version 8.3 has a disabled Access Control setting, resulting in no authentication requirement for X11 connections. This allows remote attackers to execute arbitrary commands or obtain sensitive information via X11 packets.
The vertica-udx-zygote process in HP Vertica 7.1.1 UDx does not require authentication, allowing remote attackers to execute arbitrary commands via a crafted packet.
HP ArcSight Logger, ArcSight Command Center, and ArcSight Connector Appliance use the root account to execute files owned by the arcsight user. This may allow local users to gain privileges by leveraging arcsight account access.