CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Anyterm Daemon in Infoblox Network Automation NetMRI before NETMRI-23483 allows remote attackers to execute arbitrary commands with root privileges via a crafted terminal/anyterm-module request.
The image-upgrade implementation on Cisco DX650 endpoints allows local users to execute arbitrary OS commands via an unspecified parameter.
Movable Type Pro, Open Source, and Advanced before version 5.2.12 and Pro and Advanced 6.0.x before version 6.0.7 improperly use the Perl Storable::thaw function, allowing remote attackers to include and execute arbitrary local Perl files and possibly execute arbitrary code.
In Maarch LetterBox version 2.8 and earlier and GEC/GED version 1.4 and earlier, there is an unrestricted file upload vulnerability. Remote attackers can upload a file with a PHP extension, allowing arbitrary PHP code execution.
The dwall.sys driver in SoftSphere DefenseWall Personal Firewall 3.24 allows local users to write data to arbitrary memory locations, potentially gaining privileges.
The amsnet.py file in powerpc-utils-python uses the pickle module unsafely, allowing remote attackers to execute arbitrary code via a crafted serialized object.
The auth_gssapi_unwrap_data function in MIT Kerberos 5 improperly handles partial XDR deserialization, potentially leading to denial of service or arbitrary code execution.
The krb5_gss_process_context_token function in the libgssapi_krb5 library in MIT Kerberos 5 does not properly maintain security-context handles. This can lead to denial of service or potential execution of arbitrary code via crafted GSSAPI traffic.
The Wireless Intrusion Detection (WIDS) functionality on Cisco Wireless LAN Controller (WLC) devices allows remote attackers to cause a denial of service (device outage) via crafted packets that are improperly handled during rendering of the Signature Events Summary page.
Cisco TelePresence MCU devices with software 4.5(1.45) are vulnerable to an attack that can lead to denial of service by sending an unspecified series of TCP packets. Attackers can cause the device to reload.
LG On-Screen Phone (OSP) before version 4.3.010 allows remote attackers to bypass authorization via a crafted request.
The ActiveMQ Broker in Samsung Security Manager (SSM) before version 1.31 allows remote attackers to delete arbitrary files, potentially leading to a denial of service.
Persistent Systems Radia Client Automation does not properly restrict access to certain requests, allowing remote attackers to enumerate user accounts and assign or remove roles from user accounts.
The radexecd.exe in Persistent Systems Radia Client Automation (RCA) versions 7.9, 8.1, 9.0, and 9.1 has a vulnerability that allows remote attackers to execute arbitrary commands via a crafted request to TCP port 3465.
Motorola Scanner SDK uses weak permissions for CoreScanner.exe, rsmdriverproviderservice.exe, and ScannerService.exe, allowing local users to gain privileges via unspecified vectors.
Directory traversal vulnerability in the LibraryFileUploadServlet servlet in Lexmark Markvision Enterprise allows remote authenticated users to write to and execute arbitrary files via a .. (dot dot) in a file path in a ZIP archive.
Multiple integer overflows in the GraphicBuffer::unflatten function in Android up to version 5.0 may allow attackers to gain privileges or cause a denial of service through memory corruption.
A race condition in the Common Classification Engine (CCE) in the Measurement, Aggregation, and Correlation Engine (MACE) implementation in Cisco IOS 15.4(2)T3 and earlier allows remote attackers to cause a denial of service (device reload) via crafted network traffic.
The Properties service in the D2FS web-service component in EMC Documentum D2 versions 3.1 through SP1, 4.0 and 4.1 before 4.1 P22, and 4.2 before P11 allows remote authenticated users to obtain superuser privileges via an unspecified method call that modifies group permissions.
The Zone-Based Firewall implementation in Cisco IOS 12.4(122)T and earlier does not properly manage session-object structures, allowing remote attackers to cause a denial of service (device reload) via crafted network traffic.