CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, known as Directory Traversal.
Technicolor DPC3928AD DOCSIS devices allow remote attackers to read arbitrary files via a request starting with 'GET /../' on TCP port 4321.
Docker Registry before version 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, allowing remote attackers to cause a denial of service (memory consumption) via the manifest endpoint.
In MetInfo 5.3.17, there is a directory traversal vulnerability. A remote attacker can use '..\' in the filenames parameter of /admin/system/database/filedown.php to delete any .zip file on the server.
PHICOMM K2 (PSG1218) devices running V22.5.11.5 and earlier allow unauthenticated remote code execution via a request to an unspecified ASP script. Alternatively, an attacker can leverage unauthenticated access to this script to trigger a reboot using an ifType=reboot action.
An issue was discovered in certain Apple products related to the 'Kernel' component. Affects iOS before 10.3.3, macOS before 10.12.6, tvOS before 10.2.2, and watchOS before 3.2.3.
An issue was discovered in certain Apple products related to the 'libarchive' component. It affects iOS before 10.3.3, macOS before 10.12.6, tvOS before 10.2.2, and watchOS before 3.2.3, allowing remote attackers to execute arbitrary code or cause a denial of service.
An issue was discovered in certain Apple products, including iOS before 10.3.3 and watchOS before 3.2.3, related to the 'Messages' component. It allows remote attackers to cause a denial of service through memory consumption and application crash.
An issue was discovered in certain Apple products, including iOS, macOS, tvOS, and watchOS, related to the 'Contacts' component. A buffer overflow allows remote attackers to execute arbitrary code or cause an application crash.
An issue was discovered in certain Apple products affecting iOS before 10.3.3, Safari before 10.1.2, iCloud before 6.2.2 on Windows, iTunes before 12.6.2 on Windows, and tvOS before 10.2.2. The issue involves the 'WebKit' component and allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.
An issue was discovered in certain Apple products affecting iOS before 10.3.3, Safari before 10.1.2, iCloud before 6.2.2 on Windows, iTunes before 12.6.2 on Windows, and tvOS before 10.2.2. The issue involves the 'WebKit' component and allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website.
An issue was discovered in certain Apple products affecting iOS before 10.3.3, Safari before 10.1.2, iCloud before 6.2.2 on Windows, iTunes before 12.6.2 on Windows, and tvOS before 10.2.2. The issue involves the 'WebKit' component and allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.
An issue was discovered in certain Apple products, including macOS before 10.12.6, related to the 'Bluetooth' component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
An issue was discovered in certain Apple products affecting iTunes before 12.6.2 on Windows. The issue allows attackers to execute arbitrary code in a privileged context via a crafted app.
An issue was discovered in certain Apple products affecting iOS before 10.3.3, Safari before 10.1.2, iCloud before 6.2.2 on Windows, iTunes before 12.6.2 on Windows, and tvOS before 10.2.2. The issue involves the 'WebKit' component and allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website.
An issue was discovered in certain Apple products, including macOS before 10.12.6, related to the 'Bluetooth' component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
An issue was discovered in certain Apple products, including macOS before 10.12.6, related to the 'Bluetooth' component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
An issue was discovered in certain Apple products affecting iOS before 10.3.3, Safari before 10.1.2, iCloud before 6.2.2 on Windows, iTunes before 12.6.2 on Windows, and tvOS before 10.2.2. The issue involves the 'WebKit' component and allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.
An issue was discovered in certain Apple products affecting iOS before 10.3.3, Safari before 10.1.2, iCloud before 6.2.2 on Windows, iTunes before 12.6.2 on Windows, and tvOS before 10.2.2. The issue involves the 'WebKit' component and allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.
An issue was discovered in certain Apple products related to the 'libxpc' component, allowing attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.