CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The IPv6 snooping functionality in the first-hop security subsystem in Cisco IOS improperly implements the Control Plane Protection feature, allowing remote attackers to cause a denial of service by flooding the device with ND packets.
Multiple SQL injection vulnerabilities in Web Reference Database (refbase) version 0.9.6 allow remote attackers to execute arbitrary SQL commands via the 'where' parameter in rss.php or the 'sqlQuery' parameter in search.php.
The install.php file in Web Reference Database (refbase) version 0.9.6 allows remote attackers to execute arbitrary commands via the adminPassword parameter, posing a serious security risk.
EasyIO EasyIO-30P-SF controllers with firmware before 0.5.21 and 2.x before 2.0.5.21 have a hardcoded password, making it easier for remote attackers to gain access via unspecified vectors.
Cisco AnyConnect Secure Mobility Client version 4.1(8) on OS X and Linux does not verify pathnames before installation actions, allowing local users to obtain root privileges via a crafted installation file.
The CVE-2015-6305 vulnerability in the CMainThread::launchDownloader function in vpndownloader.exe in Cisco AnyConnect Secure Mobility Client on Windows allows local users to gain privileges via a malicious DLL in the current working directory.
Cisco IOS XE 2.x and 3.x before 3.10.6S, 3.11.xS through 3.13.xS before 3.13.3S, and 3.14.xS through 3.15.xS before 3.15.1S are vulnerable to an attack that can lead to denial of service by causing device reload. Attackers can exploit IPv4 packets that require NAT and MPLS actions.
Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted Indusoft Project file.
The Remote Agent component in Schneider Electric InduSoft Web Studio before version 8.0 allows remote attackers to execute arbitrary code via unspecified vectors.
The ReadbackResultWriterD3D11::Run function in Mozilla Firefox before version 41.0 and Firefox ESR 38.x before version 38.3 misinterprets the return value of a function call. This may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact.
The reserveVertexSpace function in libGLES in ANGLE, used in Mozilla Firefox before version 41.0 and Firefox ESR 38.x before version 38.3 on Windows, incorrectly allocates memory for shader attribute arrays. This allows remote attackers to execute arbitrary code or cause a denial of service via crafted OpenGL or WebGL content.
The ProgramBinary::linkAttributes function in libGLES in ANGLE, used in Mozilla Firefox before version 41.0 and Firefox ESR 38.x before 38.3 on Windows, mishandles shader access. This allows remote attackers to execute arbitrary code or cause a denial of service via crafted OpenGL or WebGL content.
The InitTextures function in Mozilla Firefox before version 41.0 and Firefox ESR 38.x before version 38.3 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.
The AnimationThread function in Mozilla Firefox before version 41.0 and Firefox ESR 38.x before version 38.3 uses an incorrect argument to the sscanf function, which may lead to application crashes or remote attacks.
The XULContentSinkImpl::AddText function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to an 'overflow.'
The nsAttrAndChildArray::GrowBy function in Mozilla Firefox before version 41.0 and Firefox ESR 38.x before version 38.3 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to an 'overflow.'
The nsUnicodeToUTF8::GetMaxLength function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to an 'overflow.'
The ConvertDialogOptions function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.
The NetworkUtils.cpp file in Mozilla Firefox before version 41.0 and Firefox ESR 38.x before version 38.3 may have a vulnerability that allows remote attackers to cause a denial of service through memory corruption and application crash.
Mozilla Firefox before version 41.0 allows remote attackers to bypass certain ECMAScript 5 API protection mechanisms, enabling modification of immutable properties and execution of arbitrary JavaScript code with chrome privileges via a crafted web page.