CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in the HTTP traffic filtering component of Cisco Firepower Threat Defense, FirePOWER Services for ASA, and Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. This is due to improper handling of HTTP requests, including over HTTPS, with maliciously crafted headers. An attacker could send malicious requests to bypass filtering and deliver malicious content to protected systems.
A vulnerability in the normalization functionality of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The issue is due to insufficient normalization of a text-based payload. An attacker could exploit this by sending traffic with specifically obfuscated payloads through an affected device.
A vulnerability in the protocol detection component of Cisco Firepower Threat Defense, FirePOWER Services for ASA, and Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. This is due to improper detection of initial protocol use on a nonstandard port. An attacker could send traffic on a nonstandard port to bypass filtering and deliver malicious requests to protected systems.
A vulnerability in the stream reassembly component of Cisco Firepower Threat Defense Software, FirePOWER Services Software for ASA, and Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The issue is due to improper reassembly of traffic streams. An attacker could exploit this by sending crafted streams through an affected device, potentially delivering malicious requests to protected systems.
Na urządzeniach Hyundai Pay Kasse HK-1000 odkryto kanał boczny związany z wyświetlaczem OLED opartym na wierszach. Zużycie energii przez każdy cykl wyświetlacza zależy od liczby podświetlonych pikseli, co umożliwia częściowe odzyskanie zawartości wyświetlacza.
Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution (RCE). The remote process execution is bound to a web service account, which depending on the web platform used may have restricted permissions. An attempted attack requires user authentication.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
In libxslt 1.1.33, the xsltCopyText function does not reset a pointer under certain circumstances. This may lead to writing data outside a buffer or disclosing uninitialized data.
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.
W serwerze API Kubernetes w wersjach v1.0-1.12 oraz wcześniejszych niż v1.13.12, v1.14.8, v1.15.5 i v1.16.2 występuje niewłaściwa walidacja danych wejściowych, co pozwala autoryzowanym użytkownikom na wysyłanie złośliwych ładunków YAML lub JSON. Może to prowadzić do nadmiernego zużycia CPU lub pamięci, co potencjalnie skutkuje awarią serwera API.
Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.0 Base Score 8.8.
A heap-based buffer over-read exists in the terminfo library of ncurses before version 6.1-20191012 in the fmt_entry function in tinfo/comp_hash.c.
A heap-based buffer over-read exists in the terminfo library of ncurses before version 6.1-20191012 in the _nc_find_entry function in tinfo/comp_hash.c.
Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request. The flaw enables bypassing directory restrictions and executing arbitrary commands.
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application. Product: Android. Android ID: A-141720095.
An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft Windows Elevation of Privilege Vulnerability'. It could allow an attacker to gain higher privileges.
An elevation of privilege vulnerability exists in Windows Error Reporting Manager due to improper handling of hard links, known as 'Windows Error Reporting Manager Elevation of Privilege Vulnerability'.
A vulnerability in Sunny WebBox Firmware version 1.6 and earlier allows an attacker to send a malicious link to an authenticated operator. Upon clicking, the attacker can remotely perform actions with the user's permissions, exploiting the device's reliance on IP addresses for session maintenance after login.
The "managed-keys" feature in BIND allows automatic maintenance of keys used by trust anchors. Due to an error in this feature, a BIND server using managed-keys can exit due to an assertion failure if, during key rollover, a trust anchor's keys are replaced with keys using an unsupported algorithm. Affected versions: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5745.
A vulnerability in the IKEv1 feature of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a DoS condition. The issue is due to improper management of system memory. An attacker could send malicious IKEv1 traffic without valid credentials, leading to memory exhaustion and device reload.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS