CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Cisco IOS XR 4.3(.2) and earlier, used in Cisco Carrier Routing System (CRS), allows remote attackers to cause a denial of service by sending a malformed IPv6 packet.
IBM DB2 has a stack-based buffer overflow affecting versions 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP4 on Linux, UNIX, and Windows. This allows remote authenticated users to execute arbitrary code via a crafted ALTER MODULE statement.
A use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1 allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout.
A use-after-free vulnerability in the mozilla::DOMSVGLength::GetTearOff function in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1. It allows remote attackers to execute arbitrary code or cause a denial of service via an SVG animation with DOM interaction that triggers incorrect cycle collection.
Unspecified vulnerability in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before version 32.0 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
The wato component in Check_MK before 1.2.4p4 and 1.2.5 before 1.2.5i4 uses the pickle Python module unsafely, allowing remote attackers to execute arbitrary code via a crafted serialized object, related to an automation URL.
S3QL version 1.18.1 and earlier uses the pickle Python module unsafely, allowing remote attackers to execute arbitrary code via a crafted serialized object in common.py or local.py in the backends/ directory.
W funkcji acdb_ioctl w pliku audio_acdb.c w sterowniku audio acdb dla jądra Linux 2.6.x i 3.x występuje przepełnienie bufora na stosie. Umożliwia to atakującym uzyskanie uprawnień poprzez aplikację, która wykorzystuje dostęp do /dev/msm_acdb i podaje dużą wartość rozmiaru w argumencie ioctl.
The device-initialization functionality in the MSM camera driver for Linux kernel 2.6.x and 3.x allows unrestricted ioctl calls for MSM_CAM_IOCTL_SET_MEM_MAP_INFO, enabling attackers to gain privileges via a crafted application.
Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (glibc) allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via vectors related to the CHARSET environment variable and gconv transliteration modules.
vmtadmin.cgi in VMTurbo Operations Manager before version 4.6 build 28657 allows remote attackers to execute arbitrary commands via shell metacharacters in the fileDate parameter in a DOWN call.
The management console in Aruba Networks ClearPass Policy Manager version 6.3.0.60730 allows local users to execute arbitrary commands via shell metacharacters in certain arguments of a valid command.
FileUploadServlet in the Administration service in Novell GroupWise 2014 before SP1 allows remote attackers to read or write to arbitrary files via the poLibMaintenanceFileSave parameter.
Monitoring Agent for UNIX Logs in versions 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP09, and 6.2.3 through FP04, as well as Monitoring Server and Shared Libraries in versions 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP08, 6.2.3 through FP01, and 6.3.0 through FP01 in IBM Tivoli Monitoring (ITM) on UNIX allow local users to gain privileges via unspecified vectors.
CVE-2014-5399 is an SQL injection vulnerability in Schneider Electric Wonderware Information Server (WIS) Portal versions 4.0 SP1 through 5.5 that allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
The XSS vulnerability in Schneider Electric Wonderware Information Server (WIS) Portal versions 4.0 SP1 through 5.5 allows remote attackers to inject arbitrary web scripts or HTML via unspecified vectors.
A vulnerability in EMC RSA Identity Management and Governance (IMG) allows remote attackers to bypass authentication using any valid username. This affects versions 6.5.x before 6.5.1 P11, 6.5.2 before P02HF01, and 6.8.x before 6.8.1 P07 when Novell Identity Manager is used.
Schneider Electric Wonderware Information Server (WIS) Portal versions 4.0 SP1 through 5.5 uses weak encryption, allowing remote attackers to obtain sensitive information by reading a credential file.