CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
There is an illegal address access in the Eval::operator function in eval.cpp in LibSass 3.4.5. A crafted input will lead to a remote denial of service.
There is a stack consumption vulnerability in the lex function in parser.hpp in LibSass version 3.4.5, which can lead to remote denial of service through crafted input.
There is an illegal address access in the extend_alias_table function in localealias.c of Exiv2 0.26. A crafted input will lead to remote denial of service.
tcpdump version 4.9.0 has a buffer overflow in the sliplink_print function in print-sl.c.
tcpdump version 4.9.0 has a heap-based buffer over-read in the pimv1_print function in print-pim.c.
tcpdump 4.9.0 has a heap-based buffer over-read in the lldp_print function in print-lldp.c, related to util-print.c.
A hard-coded account named 'upgrade' in Fortinet FortiWLM 8.3.0 and lower versions allows a remote attacker to log-in and execute commands with 'upgrade' account privileges.
Hard-coded credentials in AmosConnect 8 allow remote attackers to gain full administrative privileges. Attackers can execute commands on the Microsoft Windows host platform with SYSTEM privileges by abusing AmosConnect Task Manager.
The Inmarsat AmosConnect 8 login form is vulnerable to blind SQL injection, allowing remote attackers to access user credentials, including usernames and passwords.
The SdpContents::Session::Medium::parse function in reSIProcate 1.10.2 allows remote attackers to cause a denial of service by triggering many media connections, leading to memory consumption.
Directory Traversal exists in ATutor before 2.2.2 via the icon parameter to /mods/_core/courses/users/create_course.php. The attacker can read an arbitrary file by visiting get_course_icon.php?id= after the traversal attack.
WG-C10 v3.0.79 and earlier allows an attacker to bypass access restrictions to obtain or alter information stored in the external storage connected to the product via unspecified vectors.
Buffer overflow in WG-C10 v3.0.79 and earlier allows an attacker to execute arbitrary commands via unspecified vectors.
WG-C10 v3.0.79 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors.
The CSRF vulnerability in WMR-433 firmware Ver.1.02 and earlier, WMR-433W firmware Ver.1.40 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
WAPM-1166D firmware Ver.1.2.7 and earlier, WAPM-APG600H firmware Ver.1.16.1 and earlier allows remote attackers to bypass authentication and access the configuration interface via unspecified vectors.
Rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation.
Cygwin versions 1.7.2 up to and including 1.8.0 are vulnerable to buffer overflow in wcsxfrm/wcsxfrm_l functions, leading to denial-of-service by crashing the process or potential hijack of the process running with administrative privileges triggered by specially crafted input string.
rkhunter versions before 1.4.4 are vulnerable to file download over insecure channel when doing mirror update resulting in potential remote code execution.
The passwd_recovery.lua file on the TP-Link Archer C9(UN)_V2_160517 allows an attacker to reset the admin password by leveraging a predictable random number generator seed. This issue is fixed in version C9(UN)_V2_170511.