CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Adobe Shockwave Player before 12.2.1.171 contains a vulnerability that allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Urządzenia Allen-Bradley MicroLogix 1100 przed wersją B FRN 15.000 oraz 1400 przed wersją B FRN 15.003 są podatne na zdalne ataki, które mogą prowadzić do odmowy usługi poprzez uszkodzenie pamięci i awarię urządzenia w wyniku spreparowanego żądania HTTP.
The web interface on Janitza UMG 508, 509, 511, 604, and 605 devices supports only short PIN values for authentication, making it easier for remote attackers to gain access via a brute-force attack.
The debug interface on Janitza UMG 508, 509, 511, 604, and 605 devices does not require authentication, allowing remote attackers to read or write files and execute arbitrary JASIC code via a session on TCP port 1239.
The FTP service on Janitza UMG 508, 509, 511, 604, and 605 devices has a default password, which makes it easier for remote attackers to read or write to files via a session on TCP port 21.
The index server (hdbindexserver) in SAP HANA 1.00.095 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via an HTTP request.
The files_external app in ownCloud Server before 7.0.9, 8.0.x before 8.0.7, and 8.1.x before 8.1.2 allows remote authenticated users to instantiate arbitrary classes and possibly execute arbitrary code via a crafted mount point option, related to 'objectstore.'
The CVE-2015-6500 vulnerability in ownCloud Server before 8.0.6 and 8.1.x before 8.1.1 allows remote authenticated users to list directory contents and possibly cause a denial of service (CPU consumption) via a .. (dot dot) in the dir parameter to index.php/apps/files/ajax/scan.php.
IBM Cognos Disclosure Management (CDM) versions 10.1.x and 10.2.x before 10.2.4 IF10 are vulnerable to man-in-the-middle attacks that allow attackers to gain access by spoofing an executable file during a client upload operation.
IBM General Parallel File System (GPFS) versions 3.5.x before 3.5.0.27 and 4.1.x before 4.1.1.2, as well as Spectrum Scale 4.1.1.x before 4.1.1.2, allow local users to obtain root privileges for command execution via unspecified vectors.
The policy implementation in Cisco FireSIGHT Management Center versions 5.3.1.7, 5.4.0.4, and 6.0.0 for VMware allows remote authenticated administrators to bypass intended policy restrictions and execute Linux commands as root.
The IKEv1 implementation in Cisco Adaptive Security Appliance (ASA) software before version 8.2(5.58), 8.3, 8.4(7.29), 8.5-8.7(1.17), 9.0(4.37), 9.1(6.8), 9.2(4), and 9.3(3) allows remote attackers to cause a denial of service (device reload) via crafted ISAKMP UDP packets.
Cisco Adaptive Security Appliance (ASA) software versions 7.2 and 8.2 before 8.2(5.58), 8.3, 8.4 before 8.4(7.29), 8.5 through 8.7 before 8.7(1.17), 9.0 before 9.0(4.37), 9.1 before 9.1(6.6), 9.2 before 9.2(4), 9.3 before 9.3(3.5), and 9.4 before 9.4(1.5) allows remote attackers to cause a denial of service (device reload) via a crafted DNS response.
Cisco Adaptive Security Appliance (ASA) software versions 7.2 and 8.2 before 8.2(5.58), 8.3 and 8.4 before 8.4(7.29), 8.5 through 8.7 before 8.7(1.17), 9.0 before 9.0(4.37), 9.1 before 9.1(6.4), 9.2 before 9.2(4), 9.3 before 9.3(3.1), and 9.4 before 9.4(1.1) allows remote attackers to cause a denial of service (device reload) via a crafted DNS response.
The DHCPv6 relay implementation in Cisco Adaptive Security Appliance (ASA) software before versions 9.0(4.37), 9.1(6.6), 9.2(4), 9.3(3.5), and 9.4(2) is vulnerable to remote attacks that can lead to denial of service via crafted DHCPv6 packets.
Multiple stack-based buffer overflows in the embeddedWebServer (also known as eWebServer) before version 2.02 allow remote attackers to execute arbitrary code via a long field in an HTTP request.
The Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to gain privileges or cause a denial of service (kernel memory corruption) via unspecified vectors.
The MCX Application Restrictions component in Apple OS X before 10.11.1, when Managed Configuration is enabled, mishandles provisioning profiles, allowing attackers to bypass intended entitlement restrictions and gain privileges via a crafted developer-signed app.
Script Editor in Apple OS X before 10.11.1 allows remote attackers to bypass an intended user-confirmation requirement for AppleScript execution via unspecified vectors.
The kernel in Apple iOS before 9.1 and OS X before 10.11.1 mishandles reuse of virtual memory, allowing attackers to cause a denial of service via a crafted app.