CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in the software-based SSL/TLS message handler of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a device reload, causing a denial of service (DoS). The issue is due to insufficient validation of SSL/TLS messages during software-based decryption. Exploitation involves sending a crafted SSL/TLS message through the device.
A vulnerability in the CLI of Cisco FTD Software could allow an authenticated, local attacker to overwrite files on the file system using directory traversal techniques. This is due to insufficient validation of user input for the file path in a specific CLI command. A successful exploit could cause system instability if important system files are overwritten.
A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypass authentication.
Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. The vendor does not consider this a vulnerability of Unbound itself, as the script is a community contribution and not part of the Unbound installation.
Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Sonatype Nexus Repository Manager 3 Pro up to and including 3.30.0 has Incorrect Access Control. The flaw may allow unauthorized access to repository resources.
In MISP 2.4.141 in app/Model/MispObject.php, an incorrect sharing group association could lead to information disclosure on an event edit. Instead of using the sharing group object, the passed local ID is reused.
A vulnerability in GitLab CE/EE from version 11.9 allows remote code execution due to improper validation of image files passed to a parser.
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing a malicious image.
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.
In Oracle HRMS (France) product of Oracle E-Business Suite (component: French HR) versions 12.1.1-12.1.3, an easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to compromise the system, leading to unauthorized creation, deletion, or modification of critical data and full access to all accessible data.
A race condition in the Linux kernel SCTP sockets implementation (net/sctp/socket.c) before version 5.12-rc8. If sctp_destroy_sock is called without the addr_wq_lock, an element is removed from the auto_asconf_splist list without proper locking. This can be exploited by an attacker with network service privileges to escalate to root or by an unprivileged user if a BPF_CGROUP_INET_SOCK_CREATE is attached that blocks creation of some SCTP sockets.
AdTran Personal Phone Manager 10.8.1 software is vulnerable to data exfiltration over DNS. Exposed web servers can be used as DNS redirectors to tunnel arbitrary data.
AdTran Personal Phone Manager software is vulnerable to multiple reflected cross-site scripting (XSS) issues. This affects at least version 10.8.1 and below, but potentially later versions as well. The affected NetVanta 7060 and NetVanta 7100 appliances are End of Life and will not receive a patch.
AdTran Personal Phone Manager software is vulnerable to an authenticated stored cross-site scripting (XSS) issue. This affects at least version 10.8.1 and earlier, but potentially later versions as well. The affected NetVanta 7060 and NetVanta 7100 appliances are End of Life and will not receive a patch.
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.
In the f2fs module of the Linux kernel (fs/f2fs/node.c) before version 5.12.0-rc4, there is an out-of-bounds (OOB) memory access flaw due to a bounds check failure. A local attacker can access out-of-bounds memory, leading to a system crash or leak of internal kernel information.
GStreamer przed wersją 1.18.4 może powodować uszkodzenie sterty podczas analizowania niektórych źle sformatowanych plików Matroska.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS