CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Connection Conversation Manager (CuCsMgr) process in Cisco Unity Connection in versions 8.5 before 8.5(1)SU7, 8.6 before 8.6(2a)SU4, and 9.x before 9.1(2)SU2, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service (core dump and restart) by improperly terminating SIP TCP connections.
The call-handling implementation in Cisco Unity Connection in versions before 8.5(1)SU7, 8.6 before 8.6(2a)SU4, 9.x before 9.1(2)SU2, and 10.0 before 10.0(1)SU1, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service (port consumption) by improperly terminating SIP sessions.
The Connection Conversation Manager (CuCsMgr) process in Cisco Unity Connection before versions 8.5(1)SU7, 8.6(2a)SU4, 9.1(2)SU2, and 10.0(1)SU1, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service via crafted SIP INVITE messages.
The Connection Conversation Manager (CuCsMgr) process in Cisco Unity Connection before version 8.5(1)SU7, 8.6 before 8.6(2a)SU4, 9.x before 9.1(2)SU2, and 10.0 before 10.0(1)SU1, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service via crafted SIP INVITE messages.
The Connection Conversation Manager (CuCsMgr) process in Cisco Unity Connection versions 8.5 before 8.5(1)SU6, 8.6 before 8.6(2a)SU4, and 9.x before 9.1(2)SU2, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service (SIP outage) via a crafted UDP packet.
The default configuration in Apache Cassandra versions 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, allowing remote attackers to execute arbitrary Java code via an RMI request.
Buffer overflow in Saitoh Kikaku Maruo Editor 8.51 and earlier allows remote attackers to execute arbitrary code via a crafted .hmbook file.
Podatność na przejście do katalogu w serwlecie fmserver w Cisco Prime Data Center Network Manager (DCNM) przed wersją 7.1(1) umożliwia zdalnym atakującym odczyt dowolnych plików za pomocą spreparowanej ścieżki. Jest to znane jako błąd CSCus00241.
Hospira MedNet before version 6.1 uses a hardcoded cleartext password to control SQL database authorization, allowing remote authenticated users to bypass intended access restrictions.
Cisco IOS XE before version 3.7.5S on ASR 1000 devices does not properly handle route adjacencies, allowing remote attackers to cause a denial of service (device hang) via crafted IP packets.
Google Chrome before 41.0.2272.118 does not properly handle the interaction of IPC, the Gamepad API, and Google V8, which allows remote attackers to execute arbitrary code via unspecified vectors.
The XcListener in SAP Afaria 7.0.6001.5 does not properly restrict access, allowing remote attackers to have unspecified impact via a crafted request.
Xen versions 4.3.x, 4.4.x, and 4.5.x, when using toolstack disaggregation, allows remote domains with partial management control to cause a denial of service (host lock) via unspecified domctl operations.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before version 37.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before version 37.0 attempts to use memset for a memory region of negative length, which may lead to arbitrary code execution or cause a denial of service through memory corruption.
The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before version 37.0 contains an incorrect memset call during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function. This allows remote attackers to execute arbitrary code or cause a denial of service via vectors that trigger rendering of 2D graphics content.
The HTMLSourceElement::BindToTree function in Mozilla Firefox before version 37.0 does not properly constrain a data type after omitting namespace validation during certain tree-binding operations, allowing remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document containing a SOURCE element.
The HTMLSourceElement::AfterSetAttr function in Mozilla Firefox before version 37.0 does not properly constrain the original data type of a casted value during the setting of a SOURCE element's attributes, allowing remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document.
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation.