CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
W urządzeniach Schneider Electric Modicon PLCs Modicon M221, M241 i M251, w wersjach oprogramowania przed odpowiednio 1.5.0.0 oraz 4.0.5.11, odkryto problem z przewidywalnym zakresem wartości. Affected products generują niewystarczająco losowe numery początkowe sekwencji TCP, co może umożliwić atakującemu przewidywanie tych numerów na podstawie wcześniejszych wartości.
An Insufficiently Protected Credentials issue was discovered in Schneider Electric Modicon PLCs M241 and M251, all firmware versions. Log-in credentials are sent over the network with Base64 encoding, making them susceptible to sniffing.
A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241 and M251. The session numbers generated by the web application lack sufficient randomization and are shared among users, potentially allowing for session compromise.
A hard-coded password issue was discovered in Becton, Dickinson and Company (BD) PerformA, Version 2.0.14.0 and prior versions, and KLA Journal Service, Version 1.0.51 and prior versions. The use of hard-coded passwords to access the BD Kiestra Database could lead to a compromise of the confidentiality of limited PHI/PII information stored in the BD Kiestra Database.
A Resource Exhaustion issue was found in Schneider Electric Modicon M340 PLC, which can lead to the device freezing. A remote attacker could send a specially crafted set of packets, causing the PLC to hang.
A Hard-Coded Passwords issue was discovered in Marel Food Processing Systems M3000 and M3210 terminals. End users do not have the ability to change system passwords, which poses a significant security risk.
In LibTIFF version 4.0.8, there is an assertion abort in the TIFFWriteDirectoryTagCheckedLong8Array function in tif_dirwrite.c. Crafted input can lead to a remote denial of service attack.
In LibSass 3.4.5, there is a heap-based buffer over-read in the function json_mkstream() in sass_context.cpp. A crafted input will lead to a remote denial of service attack.
In Netwide Assembler (NASM) 2.14rc0, there are multiple heap use after free vulnerabilities in the tool. These issues can lead to corrupted double-linked lists, double free or corruption, and out-of-bounds writes.
In ncurses 6.0, a format string vulnerability exists in the fmt_entry function. A crafted input can lead to remote arbitrary code execution.
In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input can lead to remote arbitrary code execution.
In mpg123 version 1.25.0, there is a heap-based buffer over-read in the convert_latin1 function in libmpg123/id3.c. A crafted input can lead to a remote denial of service attack.
In Piwigo up to version 2.9.1, there is an SQL injection vulnerability in the administrative backend that allows remote users to execute arbitrary SQL commands via the cat_false or cat_true parameter in the comments or status page to cat_options.php.
CVE-2017-10681 in Piwigo through 2.9.1 has a CSRF vulnerability that allows remote attackers to hijack user authentication for requests to unlock albums via a crafted request.
CVE-2017-10680 is a CSRF vulnerability in Piwigo through version 2.9.1 that allows remote attackers to hijack user authentication to change a private album to public via a crafted request.
Piwigo through 2.9.1 allows remote attackers to obtain sensitive information about the descriptive name of a permalink by examining the redirect URL that is returned in a request for the permalink ID number of a private album. The permalink ID numbers are easily guessed.
The CSRF vulnerability in Piwigo through version 2.9.1 allows remote attackers to hijack user authentication for requests to delete permalinks via a crafted request.
EMC VASA Provider Virtual Appliance versions 8.3.x and prior has an unauthenticated remote code execution vulnerability that could potentially be exploited by malicious users to compromise the affected system.
In the web management interface of Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can cause a buffer overflow.
In the web management interface of Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary characters into the pureftpd.passwd file during a username change, which in turn allows for bypassing chroot restrictions in the FTP server.