CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in the SSL/TLS handler of Cisco Firepower Threat Defense (FTD) Software on Firepower 1000 Series could allow an unauthenticated, remote attacker to trigger a DoS condition. The issue is due to a communication error between internal functions. An attacker could send a crafted SSL/TLS message, causing a buffer underrun and device crash, leading to reload.
A vulnerability in the web services interface of Cisco ASA and FTD Software allows an unauthenticated, remote attacker to retrieve memory contents, potentially leading to disclosure of confidential information. The issue is due to a buffer tracking issue when parsing invalid URLs. A successful exploit could allow memory contents retrieval, leading to information disclosure.
A vulnerability in the packet processing functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. It is due to inefficient memory management. An attacker could exploit this by sending a high rate of IPv4 or IPv6 traffic through the device, which must match a configured block action in an access control policy.
Multiple vulnerabilities in the MGCP inspection feature of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerabilities are due to inefficient memory management.
A vulnerability in the support tunnel feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to access the shell of an affected device even though expert mode is disabled. This is due to improper configuration of the support tunnel feature. An attacker could enable the support tunnel, set a key, and derive the tunnel password, allowing them to run any system command with root access.
A vulnerability in the SSL/TLS handler of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to exhaust memory resources on the affected device, leading to a DoS condition. The issue is due to improper resource management for inbound SSL/TLS connections. An attacker could exploit this by establishing multiple SSL/TLS connections with specific conditions, potentially exhausting memory and causing the device to stop accepting new SSL/TLS connections. Manual intervention is required to recover.
A vulnerability in the OSPF implementation in Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a memory leak on an affected device. The issue is due to incorrect processing of certain OSPF packets.
A vulnerability in DNS over IPv6 packet processing for Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause the device to unexpectedly reload, resulting in a denial of service (DoS) condition. The issue is due to improper length validation of a field in an IPv6 DNS packet.
A vulnerability in the VPN System Logging functionality for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a memory leak that depletes system memory over time, leading to unexpected behaviors or device crashes. It is due to improper memory freeing for VPN logging events when sessions are created or deleted.
A vulnerability in how Cisco FTD Software handles session timeouts for management connections could allow an unauthenticated, remote attacker to cause a buildup of remote management connections, leading to a DoS condition. The issue is that the default session timeout period for specific to-the-box remote management connections is too long. An attacker could exploit this by sending a large and sustained number of crafted remote management connections.
A vulnerability in the web services interface of Cisco ASA and FTD Software allows an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files. The issue is due to lack of proper input validation of the HTTP URL. A successful exploit could allow viewing or deleting arbitrary files in the web services file system, but files are restored after device reload.
A vulnerability in the management access list configuration of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured management interface access list. The issue is due to inconsistent configuration of access lists. An attacker could send crafted remote management traffic to the local IP address, bypassing the policies.
A vulnerability in the GRE tunnel decapsulation feature of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a DoS condition. The issue is due to a memory handling error when GRE over IPv6 traffic is processed. An attacker could send crafted GRE over IPv6 packets with IPv4 or IPv6 payload, causing device crash.
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, DVPN, Firewall Authentication Pass-Through with Web-Redirect, and ZTP allows an unauthenticated attacker to perform local file inclusion (LFI) or path traversal. An attacker may inject commands into httpd.log, read world-readable files, or obtain J-Web session tokens. If J-Web is enabled, the attacker could gain the same access level as a logged-in administrator.
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls, allowing a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
W Apache Log4j SMTP appender występuje niewłaściwa walidacja certyfikatu w przypadku niezgodności hosta. Może to umożliwić przechwycenie połączenia SMTPS przez atak typu man-in-the-middle, co może prowadzić do ujawnienia wszelkich wiadomości logów przesyłanych przez ten appender.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS