CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The web framework in Cisco TelePresence Advanced Media Gateway and other Cisco products before specified versions allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors.
Cisco TelePresence T, TE, and TC before version 7.1 do not properly implement access control, allowing remote attackers to obtain root privileges by sending packets on the local network. Physically proximate attackers can also gain root privileges via unspecified vectors.
Huawei E587 Mobile WiFi with firmware before version 11.203.30.00.00 allows remote attackers to bypass authentication, change configurations, send messages, and cause a denial of service (device restart) via unspecified vectors.
A stack-based buffer overflow in the run_init_sbus function in the KCodes NetUSB module for the Linux kernel allows remote attackers to execute arbitrary code by providing a long computer name in a session on TCP port 20005.
The GMS ViewPoint (GMSVP) web application in Dell Sonicwall GMS, Analyzer, and UMA EM5000 before 7.2 SP4 allows remote authenticated users to execute arbitrary commands via vectors related to configuration.
The certificate verification functions in the HNDS service in Swisscom Centro Grande (ADB) DSL routers with firmware before 6.14.00 allow remote attackers to access the management functions.
Multiple SQL injection vulnerabilities in the admin panel in osCMax before version 2.5.1 allow attackers to execute arbitrary SQL commands through parameters such as username, status, and country in various process actions.
Multiple unspecified vulnerabilities in Google V8 before 4.3.61.21, as used in Google Chrome before 43.0.2357.65, may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
A stack-based buffer overflow in IBM Domino 8.5 before 8.5.3 FP6 IF7 and 9.0 before 9.0.1 FP3 IF3 allows remote attackers to execute arbitrary code via a crafted BMP image.
A stack-based buffer overflow in IBM Domino 8.5 before 8.5.3 FP6 IF7 and 9.0 before 9.0.1 FP3 IF3 allows remote attackers to execute arbitrary code via a crafted BMP image.
Multiple unspecified vulnerabilities in Google Chrome before version 43.0.2357.65 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
In Blink, used in Google Chrome before version 43.0.2357.65, a certain width field is not initialized in HarfBuzzShaper.cpp. This may allow remote attackers to cause a denial of service or potentially have unspecified other impact via crafted Unicode text.
Multiple use-after-free vulnerabilities in the WebRTC implementation in Google Chrome before version 43.0.2357.65 may allow remote attackers to cause a denial of service or potentially have unspecified other impact via crafted JavaScript code that executes upon completion of a getUserMedia request.
PDFium, as used in Google Chrome before version 43.0.2357.65, does not properly initialize memory, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Google Chrome before 43.0.2357.65 relies on libvpx code that was not built with an appropriate --size-limit value. This allows remote attackers to trigger a negative value for a size field, potentially causing a denial of service or unspecified other impact via a crafted frame size in VP9 video data.
The SVG implementation in Blink, used in Google Chrome before version 43.0.2357.65, has an issue with improperly handling an insufficient number of values in an feColorMatrix filter. This can lead to denial of service or other unspecified impacts via a crafted document.
Use-after-free vulnerability in the SVG implementation in Blink, used in Google Chrome before version 43.0.2357.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document that leverages improper handling of a shadow tree for a use element.
In the DOM implementation in Blink, used in Google Chrome before version 43.0.2357.65, there is a vulnerability that allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that appends a child to a SCRIPT element.
In Google Chrome before version 43.0.2357.65, there is an issue with wrap handling in common/partial_circular_buffer.cc, allowing remote attackers to bypass a sandbox protection mechanism or cause a denial of service (out-of-bounds write) via vectors that trigger a write operation with a large amount of data.
IBM WebSphere Application Server (WAS) versions 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, and 8.5 before 8.5.5.6 allows remote attackers to execute arbitrary code by sending crafted instructions in a management-port session.