CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In the web management interface of Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow a user to inject arbitrary shell characters during NTP server configuration, resulting in command injection.
In the web management interface of Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow a user to inject arbitrary shell characters during manual network configuration, resulting in command injection.
In the web management interface of Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow a user to inject arbitrary shell characters during manual network configuration, resulting in command injection.
In the web management interface of Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow a user to inject arbitrary shell characters during manual network configuration, resulting in command injection.
A command injection vulnerability exists in the web management interface of the Foscam C1 Indoor HD Camera. A specially crafted HTTP request can allow an attacker to inject arbitrary shell characters during SMTP configuration tests, leading to command execution.
In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary data in the 'msmtprc' configuration file resulting in command execution. An attacker can simply send an HTTP request to the device to trigger this vulnerability.
On Lenovo VIBE mobile phones, improper access controls on the nac_server component can be abused in conjunction with CVE-2017-3749 and CVE-2017-3750 to elevate privileges to the root user.
Multiple JasperReports Server components contain vulnerabilities that may allow authorized users to perform cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. The impact of this vulnerability includes the theoretical disclosure of sensitive information.
A vulnerability in Azure AD Connect related to password writeback, if misconfigured, allows an attacker to reset passwords and gain unauthorized access to privileged on-premises AD user accounts.
The DirectX component in Microsoft Windows 10 (Gold, 1511, 1607, 1703) and Windows Server 2016 allows an authenticated attacker to run arbitrary code in kernel mode via a specially crafted application.
The graphics component in Microsoft Windows 10 (Gold, 1511, 1607, 1703) and Windows Server 2016 allows an authenticated attacker to run arbitrary code in kernel mode via a specially crafted application.
The Microsoft Malware Protection Engine on various Windows versions improperly scans a specially crafted file, leading to memory corruption. This may allow for remote code execution.
A use-after-free vulnerability in the XML-LibXML module through version 2.0129 for Perl allows remote attackers to execute arbitrary code by controlling the arguments to a replaceChild call.
A heap-based buffer overflow in the de_dotdot function in libhttpd.c in sthttpd before version 2.27.1 can be exploited by remote attackers. This may lead to a denial of service (daemon crash) or possibly other unspecified impacts via a crafted filename.
An authorization bypass in the web interface of Arcadyan SLT-00 Star* (also known as Swisscom Internet-Box) devices before R7.7 allows unauthorized reconfiguration of the static routing table via an unauthenticated HTTP request.
Apache Ignite versions from 1.0.0-RC3 to 2.0 uses an update notifier component that sends data to an external PHP server. During this communication, sensitive user information such as Apache Ignite or Java version may be transmitted.
The cdxl_decode_frame function in libavcodec/cdxl.c in FFmpeg before versions 2.8.12, 3.0.8, 3.1.8, 3.2.5, and 3.3.1 does not exclude the CHUNKY format, allowing remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
In libavcodec/scpr.c in FFmpeg version 3.3 and earlier, before version 3.3.1, height and width data is not properly validated, allowing remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
In the libavcodec library in FFmpeg before version 2.8.12 and 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1, the pix_fmt is not ensured to be set, allowing remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
FFmpeg versions before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 do not properly restrict HTTP Live Streaming filename extensions and demuxer names, allowing attackers to read arbitrary files via crafted playlist data.