CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Adobe Flash Player and Adobe AIR versions before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X, and before 11.2.202.521 on Linux, as well as Adobe AIR SDK before 19.0.0.190, allow attackers to cause a denial of service (vector-length corruption) or possibly have unspecified other impact via unknown vectors.
Adobe Flash Player and Adobe AIR before specified versions contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service through stack memory corruption.
A use-after-free vulnerability in the Update Manager service in Avira Management Console allows remote attackers to execute arbitrary code via a large header.
The ndvbs module in VBox Communications Satellite Express Protocol 2.3.17.3 allows local users to write to arbitrary physical memory locations, potentially gaining elevated privileges via a 0x00000ffd ioctl call.
Buffer overflow in form2ping.cgi on PLDT SpeedSurf 504AN and Kasda KW58293 devices allows remote attackers to cause a device outage via a long ipaddr parameter.
Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M have a default password of 'admin' for the admin account. This allows remote attackers to obtain web-management access by leveraging the ability to authenticate from the intranet.
The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands at boot time via unspecified vectors.
The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands via vectors related to 'traffic capture.'
In the management console of Symantec Web Gateway (SWG) appliances with software before version 5.2.2 DB 5.0.0.1277, the admin_messages.php file allows remote authenticated users to execute arbitrary code by uploading a file with a safe extension and content type, and then leveraging an improper Sudo configuration to make it a setuid-root file.
The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands by leveraging a 'redirect.'
Buffer overflow in the Conference Control Protocol API implementation in Cisco TelePresence Server software before version 4.1(2.33) on devices 7010, MSE 8710, Multiparty Media 310 and 320, and Virtual Machine allows remote attackers to cause a device crash via a crafted URL.
The web framework in Cisco Prime Collaboration Provisioning before version 11.0 allows remote authenticated users to bypass intended access restrictions and create administrative accounts via a crafted URL.
The web framework in Cisco Prime Collaboration Assurance before version 10.5.1.53684-1 allows remote authenticated users to bypass intended login-session read restrictions and impersonate administrators of arbitrary tenant domains by discovering a session identifier and constructing a crafted URL.
The web framework in Cisco Prime Collaboration Assurance before version 10.5.1.53684-1 allows remote authenticated users to bypass intended access restrictions, enabling the creation of administrative accounts or reading data from arbitrary tenant domains via a crafted URL.
Multiple heap-based buffer overflows in 3S-Smart CODESYS Gateway Server before version 2.3.9.34 allow remote attackers to execute arbitrary code via opcode (1) 0x3ef or (2) 0x3f0.
CVE-2015-6459 describes a vulnerability in the download feature in FileDownloadServlet in GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before version 3.1.5. It allows remote attackers to read or delete arbitrary files via a full pathname.
MDS PulseNET and MDS PulseNET Enterprise before version 3.1.5 have hardcoded credentials for a support account, allowing remote attackers to gain administrative access and execute arbitrary code.
Cisco Prime Network Registrar (CPNR) versions 8.1(3.3), 8.2(3), and 8.3(2) has a default account that allows local users to gain root access by leveraging knowledge of the credentials.
Buffer overflow in Boxoft WAV to MP3 Converter allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted WAV file.
SQL injection vulnerability in the BP_FIND_JOBS_WITH_PROGRAM function module in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.