CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A null pointer dereference vulnerability exists in the Web Application /forms/web_runScript iw_filename functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. An HTTP POST request with a blank line in the header will cause a segmentation fault in the web server.
A null pointer dereference vulnerability exists in the web application functionality of Moxa AWK-3131A Wireless Access Point running firmware version 1.1. Any HTTP GET request not preceded by a '/' will cause a segmentation fault in the web server.
An exploitable nonce reuse vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless AP running firmware 1.1. The device uses one nonce for all session authentication requests and only changes the nonce if the web application has been idle for 300 seconds.
SQL injection vulnerability in SAP Business Intelligence platform before January 2017 allows remote attackers to obtain sensitive information, modify data, cause a denial of service (data deletion), or launch administrative operations or possibly OS commands via a crafted SQL query.
SONY network cameras with firmware before version 1.86.00 are vulnerable to an attack that may lead to unauthorized access to the system. This specifically affects models SNC-CH, SNC-DH, SNC-EB, SNC-EM, SNC-ZB, SNC-ZM, and SNC-VB.
The datamover module in the Linux version of NovaBACKUP DataCenter before 09.06.03.0353 is vulnerable to remote command execution via unspecified attack vectors.
The datamover module in the Linux version of NovaBACKUP DataCenter before 09.06.03.0353 is vulnerable to remote command execution via unspecified attack vectors.
The HTTP header injection vulnerability in the URLConnection class in Android OS from version 2.2 to 6.0 allows remote attackers to execute arbitrary scripts or set arbitrary values in cookies.
The Human Monitor Interface support in QEMU allows remote attackers to cause a denial of service through out-of-bounds write and application crash.
A memory leak in QEMU's net/vmxnet3.c allows remote attackers to cause a denial of service through excessive memory consumption.
In Squashfs and sasquatch, a vulnerability allows remote attackers to cause application crashes via crafted input.
KanColleViewer versions 3.8.1 and earlier operates as an open proxy, allowing remote attackers to trigger outbound network traffic.
A vulnerability in Skia allows remote attackers to cause a denial of service by exploiting the SkRegion::setPath function.
The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the 'url' parameter.
In libosip2 in GNU oSIP versions 4.1.0 and 5.0.0, a malformed SIP message can lead to a heap buffer overflow in the msg_osip_body_parse() function.
Samsung SecEmailSync on SM-G920F build G920FXXU2COH2 (Galaxy S6) devices is vulnerable to SQL injection, also known as SVE-2015-5081.
In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the osip_body_to_str() function, resulting in a remote DoS.
In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the _osip_message_to_str() function.
In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the osip_clrncpy() function defined in osipparser2/osip_port.c.
Android versions from 4.0.3 to 5.x before 5.1 contain a vulnerability in the mediaserver component that allows attackers to gain privileges.