CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Cisco IOS versions 12.0, 12.2, 12.4, 15.0, 15.1, 15.2, 15.3 and IOS XE 2.x and 3.x before 3.7.4S are vulnerable to an attack that can lead to a denial of service (device reload) via malformed RSVP packets.
IBM System Networking switches G8052, G8124, G8124-E, G8124-ER, G8264, G8316, G8264-T and other listed models have hardcoded credentials, making it easier for remote attackers to gain access to the system.
The acpi-support package in Debian before version 0.140-5+deb7u3 allows local users to gain privileges through manipulation of the 'user's environment'.
Cobham Aviator 700D and 700E satellite terminals use an improper algorithm for PIN codes, making it easier for attackers to obtain a privileged terminal session by calculating the superuser code.
A SQL injection vulnerability was found in the Wiki Server in CoreCollaboration in Apple OS X Server before version 2.2.3 and 3.x before version 3.2.1. It allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
An unspecified IOAcceleratorFamily function in Apple OS X before 10.9.5 lacks proper bounds checking on read operations, which allows attackers to execute arbitrary code in a privileged context via a crafted application.
Buffer overflow in the shader compiler in the Intel Graphics Driver subsystem in Apple OS X before 10.9.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted GLSL shader.
Bluetooth in Apple OS X before 10.9.5 does not properly validate API calls, which allows attackers to execute arbitrary code in a privileged context via a crafted application.
IOKit in IOAcceleratorFamily in Apple OS X before 10.9.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via an application that provides crafted API arguments.
Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, and Office for Mac versions improperly parse record lengths, allowing remote attackers to execute arbitrary code via a malformed control in an Office document.
The kernel in Apple iOS before 8 and Apple TV before 7 uses a predictable random number generator during the early portion of the boot process. This allows attackers to bypass certain kernel-hardening protection mechanisms by using a user-space process to observe data related to the random numbers.
IOKit in Apple iOS before 8 and Apple TV before 7 does not properly validate IODataQueue object metadata, allowing attackers to execute arbitrary code in a privileged context.
IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via an application that provides crafted key-mapping properties.
Przepełnienie bufora oparte na stercie w IOHIDFamily w systemie Apple iOS przed wersją 8 oraz Apple TV przed wersją 7 umożliwia atakującym wykonanie dowolnego kodu w kontekście z uprawnieniami. Problem ten występuje w aplikacjach, które dostarczają spreparowane właściwości mapowania klawiszy.
Integer overflow in IOKit in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted API arguments.
IOKit in Apple iOS before 8 and Apple TV before 7 does not properly validate IODataQueue object metadata, allowing attackers to execute arbitrary code in a privileged context via an application that provides crafted values in unspecified metadata fields.
Libnotify in Apple iOS before 8 and Apple TV before 7 lacks proper bounds checking on write operations, allowing attackers to execute arbitrary code as root via a crafted application.
The IOHIDFamily kernel extension in Apple iOS before 8 and Apple TV before 7 lacks proper bounds checking on write operations, allowing attackers to execute arbitrary code in the kernel's context via a crafted application.
An unspecified IOHIDFamily function in Apple iOS before 8 and Apple TV before 7 lacks proper bounds checking, allowing attackers to bypass the ASLR protection mechanism via a crafted application.
A double free vulnerability in Apple iOS before version 8 and Apple TV before version 7 allows local users to gain privileges or cause a denial of service (device crash) via vectors related to Mach ports.