CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
IBM MQ Light before version 1.0.0.2 allows remote attackers to cause a denial of service (CPU consumption) via a crafted byte sequence in authentication data.
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection. This allows remote attackers to conduct brute-force attacks or cause denial of service via a long and duplicative list in the ssh -oKbdInteractiveDevices option.
Chiyu BF-630 and BF-630W fingerprint access-control devices allow remote attackers to bypass authentication and read or modify Voice Time Set and UniFinger configuration settings.
Cisco IOS XE versions 2.x before 2.4.3 and 2.5.x before 2.5.1 on ASR 1000 devices allows remote attackers to cause a denial of service by sending a crafted series of fragmented IPv4 or IPv6 packets.
Chiyu BF-660C fingerprint access-control devices allow remote attackers to bypass authentication and (1) read or (2) modify communication configuration settings via a request to net.htm.
CVE-2015-1492 describes an untrusted search path vulnerability in the client of Symantec Endpoint Protection 12.1 before version 12.1-RU6-MP1, allowing local users to gain privileges via a Trojan horse DLL in a client install package.
The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before version 12.1-RU6-MP1 allows remote authenticated users to gain privileges via unspecified vectors.
The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before version 12.1-RU6-MP1 allows remote attackers to bypass authentication via a crafted password-reset action, leading to a new administrative session.
A vulnerability in ISC BIND 9.x before version 9.9.7-P2 and 9.10.x before version 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
Webservice-DIC yoyaku_v41 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
Webservice-DIC yoyaku_v41 allows remote attackers to create arbitrary files, potentially leading to arbitrary code execution.
The TFTP server in Cisco IOS and IOS XE before version 3.6.0S has a vulnerability that allows remote attackers to cause a denial of service by sending multiple requests, leading to improper memory management.
The password-change feature in Cisco Unified MeetingPlace Web Conferencing before version 8.5(5) MR3 and 8.6 before version 8.6(2) does not check the session ID or require entry of the current password, allowing remote attackers to reset arbitrary passwords via a crafted HTTP request.
Cisco Application Policy Infrastructure Controller (APIC) and Nexus 9000 ACI devices with software before version 1.0(3o) and 11.0(4o) do not properly restrict access to the APIC filesystem, allowing remote authenticated users to obtain root privileges.
Directory traversal vulnerability in EMC Avamar Server 7.x before 7.1.2 and Avamar Virtual Addition (AVE) 7.x before 7.1.2 allows remote attackers to read arbitrary files by using the Avamar Desktop/Laptop client interface to send crafted parameters.
Multiple unspecified vulnerabilities in Google Chrome before version 44.0.2403.89 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
The LocalFrame::isURLAllowed function in Blink, used in Google Chrome before version 44.0.2403.89, does not properly check for a page's maximum number of frames. This allows remote attackers to cause a denial of service or potentially have unspecified other impact via crafted JavaScript code.
In Skia, used in Google Chrome before version 44.0.2403.89, there is a vulnerability that allows remote attackers to cause a denial of service (memory corruption) by leveraging access to a renderer process and providing crafted serialized data.
Integer overflow in the CJBig2_Image::expand function in PDFium, used in Google Chrome before version 44.0.2403.89, may lead to denial of service (heap-based buffer overflow) or other unspecified impacts due to large height and stride values.
Use-after-free vulnerability in the accessibility implementation in Google Chrome before version 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging lack of certain validity checks for accessibility-tree data structures.