CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in Cisco IOS 15.1(2)SY3 and earlier, when used with Supervisor Engine 2T on Catalyst 6500 devices, allows remote attackers to cause a device crash via crafted multicast packets.
The End User Safelist/Blocklist (SLBL) service in Cisco AsyncOS Software for Email Security Appliance (ESA) and Cisco Content Security Management Appliance (SMA) before specified versions allows remote authenticated users to execute arbitrary code with root privileges via an FTP session that uploads a modified SLBL database file.
Multiple SQL injection vulnerabilities in MantisBT before version 1.2.16 allow remote attackers to execute arbitrary SQL commands via unspecified parameters in various API functions.
A stack-based buffer overflow exists in the 'Add from text file' feature of the DameWare Exporter tool. This allows user-assisted attackers to execute arbitrary code.
In versions of Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25, there is a vulnerability that does not prevent a zero-length transition during the use of an ArrayBuffer object. This allows remote attackers to execute arbitrary code or cause a denial of service.
A use-after-free vulnerability in the TypeObject class in the JavaScript engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary code by triggering extensive memory consumption during garbage collection.
Buffer overflow in the _cairo_truetype_index_to_ucs4 function in cairo, used in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25, allows remote attackers to execute arbitrary code via a crafted extension that renders fonts in a PDF document.
The CVE-2014-1507 vulnerability in the DeviceStorage API in Mozilla FirefoxOS before version 1.2.2 allows attackers to bypass the media sandbox protection mechanism, enabling them to read or modify arbitrary files via a crafted application.
The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive displacement-correlation information and possibly bypass the Same Origin Policy to read text from a different domain via a timing attack involving feDisplacementMap elements.
The mozilla::WaveReader::DecodeAudioData function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process heap memory, cause a denial of service (out-of-bounds read and application crash), or possibly have unspecified other impact via a crafted WAV file.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.
A memory leak in the TCP stack in the kernel in Sophos UTM before version 9.109 allows remote attackers to cause a denial of service through unspecified vectors.
A stack-based buffer overflow in the CDownloads_Deleted::UpdateDownload function in Downloads_Deleted.cpp in Free Download Manager allows user-assisted remote attackers to execute arbitrary code via a long file name, which is then deleted from the download queue by the user.
SQL injection vulnerability in the mci_file_get function in api/soap/mc_file_api.php in MantisBT before version 1.2.16 allows remote attackers to execute arbitrary SQL commands via a crafted envelope tag in a mc_issue_attachment_get SOAP request.
The x_button method in the ServiceController in Red Hat CloudForms 3.0 Management Engine 5.2 allows remote attackers to execute arbitrary methods via unspecified vectors.
Integer overflow in xnview.exe in XnView 2.13 allows remote attackers to execute arbitrary code via a large NUM_ELEMENTS field in an IFD_ENTRY structure in a JXR file, triggering a heap-based buffer overflow.
Sophos Web Appliance versions before 3.7.8.2 allow remote attackers to execute arbitrary commands via shell metacharacters in the client-ip parameter on the Block page and remote authenticated users to execute arbitrary commands via shell metacharacters in the url and entries parameters.
A vulnerability in /sbin/ifwatchd in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to gain elevated privileges by providing an arbitrary program name as a command-line argument.
Siemens SIMATIC S7-1500 CPU PLC devices with firmware before version 1.5.0 are vulnerable to remote attacks that can lead to denial of service via crafted HTTPS packets.
Siemens SIMATIC S7-1500 CPU PLC devices with firmware before version 1.5.0 are vulnerable to remote attacks that can lead to denial of service via crafted ISO-TSAP packets.