CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The GIF encoder in Byzanz allows remote attackers to cause a denial of service (out-of-bounds heap write and crash) or possibly execute arbitrary code via a crafted Byzanz debug data recording (ByzanzRecording file) to the byzanz-playback command.
Multiple buffer overflows in pbm212030 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted PBM image. These issues are related to stream line data and vectors associated with an internal intermediate heap-based buffer.
The RPC daemon in EMC Isilon OneFS versions 6.5.x and 7.0.x before 7.0.2.13, 7.1.0 before 7.1.0.6, 7.1.1 before 7.1.1.2, and 7.2.0 before 7.2.0.1 allows local users to gain privileges by modifying system files.
A stack-based buffer overflow in the PmBase64Decode function in an unspecified demonstration application in MICROSYS PROMOTIC before version 8.2.19 and PROMOTIC development before version 8.3.2 allows remote attackers to execute arbitrary code by providing a large amount of data.
CVE-2014-5428 describes an unrestricted file upload vulnerability in unspecified web services in Johnson Controls Metasys versions 4.1 through 6.5. This allows remote attackers to execute arbitrary code by uploading a shell script.
The DHCP implementation in the PowerOn Auto Provisioning (POAP) feature in Cisco NX-OS does not properly restrict the initialization process, allowing remote attackers to execute arbitrary commands as root by sending crafted response packets on the local network.
SVM in Websense TRITON V-Series appliances before version 8.0.0 allows attackers to upload arbitrary files via unspecified vectors.
Unspecified vulnerability in Websense TRITON AP-EMAIL before version 8.0.0, related to 'Autocomplete Enabled', may lead to unknown impact and attack vectors.
Unspecified vulnerability in Websense TRITON AP-EMAIL before version 8.0.0, related to port 17703, has unknown impact and attack vectors.
Movable Type before 5.2.6 does not properly use the Storable::thaw function, allowing remote attackers to execute arbitrary code via the comment_state parameter.
Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 does not properly restrict access to the Advent Java Management Extensions (JMX) Servlet, allowing remote attackers to execute arbitrary code.
The Service Discovery Gateway (mDNS Gateway) in Cisco IOS and IOS XE allows remote attackers to cause a denial of service by sending malformed mDNS UDP packets, leading to device reload.
Cisco IOS versions 12.2, 12.4, 15.0, 15.2, and 15.3 allow remote attackers to cause a denial of service (device reload) via malformed Common Industrial Protocol (CIP) TCP packets.
A memory leak in Cisco IOS versions 12.2, 12.4, 15.0, 15.2, and 15.3 allows remote attackers to cause a denial of service through crafted Common Industrial Protocol (CIP) TCP packets.
Cisco IOS versions 12.2, 12.4, 15.0, 15.2, and 15.3 allow remote attackers to cause a denial of service (device reload) via malformed Common Industrial Protocol (CIP) UDP packets.
A memory leak in the TCP input module in Cisco IOS allows remote attackers to cause a denial of service by sending crafted TCP packets. This can lead to memory consumption or device reload.
The Layer 4 Redirect (L4R) feature in Cisco IOS XE 2.x and 3.x before 3.10.4S, 3.11 before 3.11.3S, 3.12 before 3.12.2S, 3.13 before 3.13.1S, 3.14 before 3.14.0S, and 3.15 before 3.15.0S allows remote attackers to cause a denial of service (device reload) via malformed IPv4 or IPv6 packets.
AppNav in Cisco IOS XE versions 3.8 through 3.10 before 3.10.3S, 3.11 before 3.11.3S, 3.12 before 3.12.1S, 3.13 before 3.13.0S, 3.14 before 3.14.0S, and 3.15 before 3.15.0S allows remote attackers to execute arbitrary code or cause a denial of service (device reload) via a crafted TCP packet, aka Bug ID CSCuo53622.
Cisco IOS versions 12.2, 12.4, 15.0, 15.1, 15.2, 15.3, and 15.4, as well as IOS XE versions 2.5.x, 2.6.x, 3.1.xS through 3.12.xS before 3.12.3S, 3.2.xE through 3.7.xE before 3.7.1E, 3.3.xSG, 3.4.xSG, and 3.13.xS before 3.13.2S are vulnerable to denial of service attacks by sending malformed IKEv2 packets. Attackers can exploit this vulnerability to cause memory consumption and device reload.
Cisco IOS versions 12.2, 12.4, 15.0, 15.1, 15.2, 15.3, and 15.4, as well as IOS XE versions 2.5.x, 2.6.x, 3.1.xS through 3.12.xS before 3.12.3S, 3.2.xE through 3.7.xE before 3.7.1E, 3.3.xSG, 3.4.xSG, and 3.13.xS before 3.13.2S are vulnerable to an attack that can cause a device reload by sending malformed IKEv2 packets. This vulnerability can be exploited over both IPv4 and IPv6 networks.