CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
There is an untrusted search path vulnerability in the installer of PhishWall Client before version 3.7.8.2 for Internet Explorer.
The Akerun - Smart Lock Robot App for iOS before version 1.2.4 does not verify SSL certificates, which may lead to man-in-the-middle attacks.
Android allows users to cause a denial of service.
WonderCMS before 2.0.3 is vulnerable to CSRF due to a lack of a token in an unspecified context.
OpenText Documentum Content Server allows superuser access via sys_obj_save or save of a crafted object, followed by an unauthorized 'UPDATE dm_dbo.dm_user_s SET user_privileges=16' command, known as an 'RPC save-commands' attack.
The Reporting Module 1.12.0 for OpenMRS allows CSRF attacks resulting in XSS, where administrative authentication is hijacked to insert JavaScript into a name field in webapp/reports/manageReports.jsp.
A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) allows an authenticated, remote attacker to execute arbitrary commands on an affected system. The issue arises from insufficient sanitization of user-supplied HTTP input.
A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker to execute arbitrary code on an affected system. The vulnerability exists because the affected software does not sufficiently sanitize specific values that are received as part of a user-supplied HTTP request.
A vulnerability in the IKEv1 XAUTH code of Cisco ASA Software could allow an authenticated, remote attacker to cause a reload of an affected system. The issue is due to insufficient validation of the XAUTH parameters during IKEv1 negotiation.
A vulnerability in the IPsec code of Cisco ASA Software could allow an authenticated, remote attacker to cause a reload of the affected system. The vulnerability is due to improper parsing of malformed IPsec packets.
A vulnerability in the SSL and TLS code of Cisco ASA Software could allow an unauthenticated, remote attacker to cause a reload of the affected system. The issue is due to improper parsing of crafted SSL or TLS packets.
A vulnerability in the DNS code of Cisco ASA Software could allow an unauthenticated, remote attacker to cause an affected device to reload or corrupt the information present in the device's local DNS cache. The vulnerability is due to a flaw in handling crafted DNS response messages.
Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow an unauthenticated, remote attacker to cause a buffer overflow condition or a reload of an affected device, leading to a denial of service (DoS) condition. These vulnerabilities are due to improper parsing of crafted EnergyWise packets destined to an affected device.
Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow an unauthenticated, remote attacker to cause a buffer overflow condition or a reload of an affected device, leading to a denial of service (DoS) condition. These vulnerabilities are due to improper parsing of crafted EnergyWise packets destined to an affected device.
Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow an unauthenticated, remote attacker to cause a buffer overflow condition or a reload of an affected device, leading to a denial of service (DoS) condition. These vulnerabilities are due to improper parsing of crafted EnergyWise packets destined to an affected device.
Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow an unauthenticated, remote attacker to cause a buffer overflow condition or a reload of an affected device, leading to a denial of service (DoS) condition. These vulnerabilities are due to improper parsing of crafted EnergyWise packets destined to an affected device.
A vulnerability in the Session Initiation Protocol (SIP) UDP throttling process of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient rate limiting protection.
A vulnerability in the detection engine parsing of Pragmatic General Multicast (PGM) protocol packets for Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition due to the Snort process unexpectedly restarting. The vulnerability is due to improper input validation of the fields in the PGM protocol packet.
IBM Security Guardium versions 8.2, 9.0, and 10.0 contain a vulnerability that could allow a local attacker with CLI access to inject arbitrary commands which would be executed as root.
The CSRF vulnerability in Red Hat JBoss BRMS and BPMS 6 allows remote attackers to hijack user authentication for requests that modify instances via a crafted web page.