CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in the ingress flow creation functionality of Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause CPU utilization to increase upwards of 100%, leading to a denial of service (DoS) condition. The issue is due to incorrect handling of an internal software lock that can prevent other system processes from getting CPU cycles. An attacker could exploit this by sending a steady stream of malicious IP packets, potentially exhausting CPU resources and causing traffic delays.
A vulnerability in the SSL VPN Client Certificate Authentication feature for Cisco ASA and FTD could allow an unauthenticated, remote attacker to establish an SSL VPN connection and bypass certain SSL certificate verification steps. The issue is due to incorrect verification of the SSL Client Certificate. An attacker could exploit this by connecting without a proper private key and certificate pair, allowing a connection that should have been rejected.
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server.
Vulnerability in Spring Data Commons (versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions) due to unlimited resource allocation during property path parsing. An unauthenticated attacker can send requests to Spring Data REST endpoints or endpoints using property path parsing, causing denial of service (high CPU and memory consumption).
The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.
Vulnerability in Spring Data Commons (versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions) due to improper neutralization of special elements in the property binder. An unauthenticated remote attacker can supply specially crafted request parameters against Spring Data REST backed HTTP resources or use Spring Data's projection-based request payload binding, leading to remote code execution.
W wersjach ARM mbed TLS przed 2.1.11, 2.7.2 i 2.8.0 występuje błąd przepełnienia bufora w funkcji ssl_parse_server_psk_hint(), który może prowadzić do awarii przy nieprawidłowym wejściu.
W wersjach ARM mbed TLS przed 2.1.11, 2.7.2 i 2.8.0 występuje błąd przepełnienia bufora w funkcji ssl_parse_server_key_exchange(), który może prowadzić do awarii przy nieprawidłowym wejściu.
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
Multiple vulnerabilities in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition. These vulnerabilities affect Cisco devices running Cisco IOS Software Release 15.4(2)T, 15.4(3)M, or 15.4(2)CG and later.
Multiple vulnerabilities in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition. These vulnerabilities affect Cisco devices running Cisco IOS Software Release 15.4(2)T, 15.4(3)M, or 15.4(2)CG and later.
Format String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. Cisco Bug IDs: CSCvd73664.
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validation of option 82 information that it receives in DHCP Version 4 (DHCPv4) packets from DHCP relay agents. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCuh91645.
A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a Relay Reply denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validation of encapsulated option 82 information that it receives in DHCPOFFER messages from DHCPv4 servers. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device, which the device would then forward to a DHCPv4 server. When the affected software processes the option 82 information that is encapsulated in the response from the server, an error could occur. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCvg62754.
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS and IOS XE Software allows an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS). It exists because the software performs incomplete input validation of option 82 information in DHCPv4 packets from DHCP relay agents. Sending a crafted DHCPv4 packet can cause a heap overflow and device reload.
A vulnerability in the Smart Install feature of Cisco IOS and IOS XE Software is caused by improper validation of packet data. An unauthenticated remote attacker can send a crafted Smart Install message to TCP port 4786, causing a buffer overflow that may lead to device reload, arbitrary code execution, or a watchdog crash.
Multiple buffer overflow vulnerabilities in the LLDP subsystem of Cisco IOS, IOS XE, and IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) or execute arbitrary code with elevated privileges. The issue affects LLDP packet processing.
A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Switches could allow an authenticated, remote attacker to cause a denial of service (DoS) condition, aka a GET MIB Object ID Denial of Service Vulnerability. The vulnerability occurs when the affected software processes an SNMP read request containing a request for the ciscoFlashMIB object ID, which could cause the device to restart due to a SYS-3-CPUHOG. This affects Cisco Catalyst 2960-L Series Switches, Cisco Catalyst Digital Building Series Switches 8P and 8U running SNMPv2 or SNMPv3.
A vulnerability in the IKEv1 implementation of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS). It is due to improper validation of specific IKEv1 packets. Sending crafted IKEv1 packets during IKE negotiation can cause a device reload.
A vulnerability in the IKEv2 module of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device, leading to a denial of service (DoS). It is due to incorrect processing of certain IKEv2 packets. Sending crafted IKEv2 packets can cause continuous memory consumption and eventual device reload.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS