CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass file policies configured to block files transmitted via the BitTorrent protocol. The issue is due to incorrect detection of BitTorrent handshake messages. An attacker could exploit this by sending a crafted BitTorrent connection request to an affected device.
A vulnerability in the web interface of Cisco RV132W ADSL2+ Wireless-N VPN and RV134W VDSL2 Wireless-AC VPN Routers is due to incomplete input validation on user-controlled input in an HTTP request. An unauthenticated remote attacker can send a crafted HTTP request to execute arbitrary code with root privileges and gain full control of the system or cause it to reload.
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. It occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution, and it was exploited in the wild in January and February 2018.
A vulnerability in the SSL VPN functionality of Cisco ASA Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The issue is due to a double-free memory condition when the webvpn feature is enabled. An attacker could exploit this by sending multiple crafted XML packets to a webvpn-configured interface.
Apache POI versions prior to 3.17 are vulnerable to Denial of Service attacks. These issues include infinite loops while parsing crafted WMF, EMF, MSG files and macros, as well as Out of Memory exceptions while parsing DOC, PPT, and XLS files.
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to unauthenticated remote code execution. An attacker can transfer a serialized Java SignedObject to the Jenkins CLI, which is deserialized using a new ObjectInputStream, bypassing the existing blacklist-based protection mechanism.
W OpenSSH przed wersją 7.4 występuje podatność, która pozwala zdalnym atakującym na spowodowanie odmowy usługi poprzez dereferencję wskaźnika NULL i awarię demona, wykorzystując nieprawidłową sekwencję wiadomości NEWKEYS.
Equation Editor in Microsoft Office 2007, 2010, 2013, and 2016 has a remote code execution vulnerability due to improper handling of objects in memory, aka 'Microsoft Office Memory Corruption Vulnerability'. This CVE is unique from CVE-2018-0797 and CVE-2018-0812.
Equation Editor in Microsoft Office 2007, 2010, 2013, and 2016 has a remote code execution vulnerability due to improper handling of objects in memory, aka 'Microsoft Office Memory Corruption Vulnerability'.
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution.
A vulnerability in Trustwave Secure Web Gateway (SWG) through version 11.8.0.27 allows remote attackers to append an arbitrary public key to the device's SSH Authorized Keys data, leading to remote root access.
A door-unlocking issue was discovered on Software House iStar Ultra devices through version 6.5.2.20569 when used with the IP-ACM Ethernet Door Module. The communications between the IP-ACM and the iStar Ultra are encrypted using a fixed AES key and IV, leading to replay attacks and message forgery.
Red Lion HMI panels allow remote attackers to cause a denial of service (software exception) via an HTTP POST request to a long URI that does not exist.
In Wireshark before version 2.2.12, the MRDISC dissector misuses a NULL pointer, causing the program to crash. This issue was addressed by validating an IPv4 address.
The Biometric Shift Employee Management System allows arbitrary file download via directory traversal sequences in the form_file_name parameter in a download_form action.
The Biometric Shift Employee Management System has a CSRF vulnerability in index.php in the edit_holiday action.
PHP Scripts Mall Muslim Matrimonial Script allows arbitrary file upload via admin/mydetails_edit.php.
PHP Scripts Mall Muslim Matrimonial Script is vulnerable to SQL injection via the mem_id parameter in the view-profile.php file.
ZyXEL P-660HW v3 devices are vulnerable to a remote denial of service attack that can be executed by flooding the device with IP packets having a TTL of 1, leading to high CPU consumption.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS