CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in the PAM configuration of Cisco Firepower Threat Defense (FTD), Firepower Management Center (FMC), and FXOS Software could allow an authenticated, remote attacker to cause a DoS condition. The issue is due to improper resource management in user session management. An attacker could exploit this by connecting and performing many simultaneous successful SSH logins, exhausting system resources and causing a device reload.
A vulnerability in the CLI of Cisco FXOS and FTD Software could allow an authenticated, local attacker to execute commands on the underlying OS with root privileges. The issue is due to insufficient input validation. An attacker could exploit this by including crafted arguments to specific CLI commands.
A vulnerability in the WebVPN feature of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause increased CPU utilization on an affected device. The issue is due to excessive processing load for a specific WebVPN HTTP page request. An attacker could send multiple WebVPN HTTP page load requests for a specific URL, leading to increased CPU load and DoS.
A vulnerability in the Clientless SSL VPN (WebVPN) portal of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The issue is due to insufficient validation of user-supplied input. An attacker could exploit this by persuading a user to click a crafted link.
A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) could allow an authenticated, local attacker with administrative privileges to execute commands on the underlying OS with root privileges. This is due to insufficient input validation.
A vulnerability in the SIP inspection module of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The issue is due to improper parsing of SIP messages.
A vulnerability in the OSPF implementation of Cisco ASA and FTD Software could allow an unauthenticated, adjacent attacker to cause a reload of an affected device, resulting in a denial of service (DoS). The issue is due to improper parsing of certain options in OSPF LSA type 11 packets. An attacker could exploit this by sending a crafted LSA type 11 OSPF packet.
Multiple vulnerabilities in the multi-instance feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to escape the container for their FTD instance and execute commands with root privileges in the host namespace. These vulnerabilities are due to insufficient protections on the underlying filesystem. An attacker could exploit these by modifying critical files, leading to root command execution and impacting other FTD instances.
Multiple vulnerabilities in the multi-instance feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to escape the container for their FTD instance and execute commands with root privileges in the host namespace. These vulnerabilities are due to insufficient protections on the underlying filesystem. An attacker could exploit these by modifying critical files, leading to root command execution and impacting other FTD instances.
A vulnerability in the FTP inspection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. It is due to insufficient validation of FTP data. An attacker could exploit this by sending malicious FTP traffic through the device.
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.
Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.
Wersje Arm Mbed TLS przed 2.19.0 oraz Arm Mbed Crypto przed 2.0.0, przy włączonym deterministycznym ECDSA, wykorzystują generator liczb losowych z niewystarczającą entropią do osłony, co może umożliwić atakującemu odzyskanie klucza prywatnego za pomocą ataków bocznych, jeśli ofiara podpisuje tę samą wiadomość wielokrotnie.
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request. The flaw enables an attacker to execute arbitrary code on the server.
A remote code execution vulnerability exists in Internet Explorer due to the scripting engine improperly handling objects in memory, known as 'Scripting Engine Memory Corruption Vulnerability'.
Red Lion Controls Crimson w wersji 3.0 i wcześniejszych oraz w wersji 3.1 przed wydaniem 3112.00, pozwala na wykorzystanie wielu podatności, gdy ważny użytkownik otworzy specjalnie przygotowany, złośliwy plik wejściowy, który może odwoływać się do pamięci po jej zwolnieniu.
Red Lion Controls Crimson w wersji 3.0 i wcześniejszych oraz w wersji 3.1 przed wydaniem 3112.00 używa twardo zakodowanego hasła do szyfrowania chronionych plików w trakcie przesyłania i w spoczynku, co może umożliwić atakującemu dostęp do plików konfiguracyjnych.
Red Lion Controls Crimson w wersji 3.0 i wcześniejszych oraz w wersji 3.1 przed wydaniem 3112.00 pozwala na wykorzystanie wielu podatności, gdy ważny użytkownik otworzy specjalnie przygotowany, złośliwy plik wejściowy, co prowadzi do niewłaściwego zarządzania wskaźnikami przez program.
Red Lion Controls Crimson w wersji 3.0 i wcześniejszych oraz w wersji 3.1 przed wydaniem 3112.00, pozwala na wykorzystanie wielu podatności, gdy uprawniony użytkownik otworzy specjalnie przygotowany, złośliwy plik wejściowy, który działa poza wyznaczonym obszarem pamięci.
Wtyczka Bloom od Elegant Themes przed wersją 1.1.1 dla WordPressa ma lukę umożliwiającą eskalację uprawnień. Atakujący może wykorzystać tę podatność do uzyskania wyższych uprawnień w systemie.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS