CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Cisco IOS XE versions 2.x and 3.x before 3.9.0S, 3.10 before 3.10.0S, 3.11 before 3.11.0S, 3.12 before 3.12.0S, 3.13 before 3.13.0S, 3.14 before 3.14.0S, and 3.15 before 3.15.0S are vulnerable to a denial of service attack that can cause device reload via crafted IPv6 packets. This vulnerability is known as Bug ID CSCub68073.
The high-speed logging (HSL) feature in Cisco IOS XE 2.x and 3.x before version 3.10.4S and other specified versions is vulnerable to remote attacks that can lead to denial of service by sending large IP packets requiring NAT and HSL processing after fragmentation.
The Common Flow Table (CFT) feature in Cisco IOS XE versions 3.6 and 3.7 before 3.7.1S and in versions 3.8 to 3.15 before respective updates allows remote attackers to cause a denial of service (device reload) via malformed IPv6 packets with IPv4 UDP encapsulation.
In Cisco IOS versions 12.2, 12.4, 15.0, 15.2, and 15.3, configuring a VRF interface allows remote attackers to cause a denial of service (interface queue wedge) via crafted ICMPv4 packets.
The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS versions 12.2, 12.4, 15.0, 15.2, 15.3, and 15.4 and IOS XE 3.10.xS through 3.13.xS before 3.13.1S allows remote attackers to cause a denial of service (device reload) via spoofed AN messages.
The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS has a vulnerability that allows remote attackers to cause a denial of service via spoofed AN messages that reset a finite state machine. This affects IOS versions 12.2, 12.4, 15.0, 15.2, 15.3, 15.4 and IOS XE 3.10.xS through 3.13.xS before 3.13.1S.
The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS versions 12.2, 12.4, 15.0, 15.2, 15.3, and 15.4 and IOS XE 3.10.xS through 3.13.xS before 3.13.1S allows remote attackers to spoof Autonomic Networking Registration Authority (ANRA) responses. This can lead to bypassing intended device and node access restrictions or cause a denial of service.
The userlogin.jsp in SolarWinds Firewall Security Manager (FSM) before version 6.6.5 HotFix1 allows remote attackers to gain privileges and execute arbitrary code via unspecified vectors related to client session handling.
The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the model or PDL.
A vulnerability in tcpdump before version 4.7.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
The 'RAP console' feature in ArubaOS versions 5.x through 6.2.x, 6.3.x before 6.3.1.15, and 6.4.x before 6.4.2.4 on Aruba access points in Remote Access Point (AP) mode allows remote attackers to execute arbitrary commands via unspecified vectors.
Integer signedness error in the mobility_opt_print function in the IPv6 mobility printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) or possibly execute arbitrary code via a negative length value.
A vulnerability in IBM General Parallel File System (GPFS) allows remote attackers to bypass authentication and execute arbitrary programs as root in certain cipherList configurations. It affects versions 3.4 before 3.4.0.32, 3.5 before 3.5.0.24, and 4.1 before 4.1.0.7.
IBM General Parallel File System (GPFS) versions 3.4 before 3.4.0.32, 3.5 before 3.5.0.24, and 4.1 before 4.1.0.7 allows local users to obtain root privileges for program execution via unspecified vectors.
Mozilla Firefox before 36.0.4, Firefox ESR 31.x before 31.5.3, and SeaMonkey before 2.33.1 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving SVG hash navigation.
Multiple SQL injection vulnerabilities in MetalGenix GeniXCMS before version 0.0.2 allow remote attackers to execute arbitrary SQL commands via the (1) page parameter to index.php or (2) username parameter to gxadmin/login.php.
Futomi CGI Cafe MP Form Mail CGI eCommerce versions before 2.0.12 on Windows allows remote attackers to execute arbitrary Perl code via unspecified vectors.
SQL injection vulnerability in groups.php in Vastal I-Tech phpVID versions 0.9.9 and 1.2.3 allows remote attackers to execute arbitrary SQL commands via the order_by parameter.
Multiple SQL injection vulnerabilities in the Web-Dorado ECommerce WD (com_ecommercewd) component 1.2.5 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) search_category_id, (2) sort_order, or (3) filter_manufacturer_ids in a displayproducts action to index.php.
The bdfReadCharacters function in X.Org libXfont before version 1.4.9 and 1.5.x before 1.5.1 does not properly perform type conversion for metrics values. This allows remote authenticated users to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via a crafted BDF font file.