CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Untrusted Java serialization in Soffid IAM console before 1.7.5 allows remote attackers to achieve arbitrary remote code execution via a crafted authentication request.
WebsiteBaker v2.10.0 has a SQL injection vulnerability in /account/details.php.
The multi-part body parser in PJSIP, used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.
A memory exhaustion vulnerability exists in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1 and Certified Asterisk 13.13 before 13.13-cert4. It can be triggered by sending specially crafted SCCP packets causing an infinite loop and leading to memory exhaustion.
In Wireshark versions 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the RGMP dissector could crash. This issue was addressed by validating an IPv4 address.
In Wireshark versions 2.2.0 to 2.2.6, the IPv6 dissector could crash. This was addressed by validating an IPv6 address.
In Wireshark versions 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the Bazaar dissector could go into an infinite loop. This was addressed by ensuring that backwards parsing cannot occur.
In Wireshark versions 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DHCP dissector could read past the end of a buffer. This was addressed by extracting the Vendor Class Identifier more carefully.
In Wireshark versions 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the openSAFETY dissector could crash or exhaust system memory. This was addressed by checking for a negative length.
In Wireshark versions 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DICOM dissector has an infinite loop. This was addressed by validating a length value.
In Wireshark versions 2.2.0 to 2.2.6, the DOF dissector could read past the end of a buffer. This issue was addressed by validating a size value.
In Wireshark versions 2.2.0 to 2.2.6, the ROS dissector could crash due to a NULL pointer dereference. This was addressed by validating an OID.
In Wireshark versions 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the SoulSeek dissector could go into an infinite loop. This was addressed by making loop bounds more explicit.
In Wireshark versions 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DNS dissector could go into an infinite loop. This was addressed by trying to detect self-referencing pointers.
In Wireshark versions 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the Bluetooth L2CAP dissector could divide by zero. This was addressed by validating an interval value.
In Wireshark versions 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the MSNIP dissector misuses a NULL pointer. This was addressed by validating an IPv4 address.
In git-shell before version 2.4.12 and in versions 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3, there is a possibility that remote authenticated users can gain privileges via a repository name starting with a - (dash) character.
Palo Alto Networks Panorama VM Appliance with PAN-OS before 6.0.1 might allow remote attackers to execute arbitrary Python code via a crafted firmware image file.
Multiple directory traversal vulnerabilities in Samsung SyncThru 6 before 1.0 allow remote attackers to delete arbitrary files or execute arbitrary code with SYSTEM privileges.
Ceragon FibeAir IP-10 has a default SSH public key in the authorized_keys file for the mateidu user, allowing remote attackers to gain SSH access by leveraging knowledge of the private key.