CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Sierra Wireless GX 440 devices with ALEOS firmware version 4.3.2 allow Hayes AT command injection.
Sierra Wireless GX 440 devices with ALEOS firmware version 4.3.2 have weak passwords for admin, rauser, sconsole, and user accounts.
Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow command injection via the Embedded_Ace_Set_Task.cgi script.
OSRAM SYLVANIA Osram Lightify Pro through July 26, 2016 allows Zigbee replay.
Osram Lightify Pro through July 26, 2016, does not use SSL pinning, which may lead to man-in-the-middle attacks.
Osram Lightify Pro before July 26, 2016, uses only 8 hex digits for a PSK, which may weaken security.
Osram Lightify Home through July 26, 2016, allows Zigbee replay, which may lead to unauthorized access to the system.
Osram Lightify Home before July 26, 2016, allows remote attackers to execute arbitrary commands via TCP port 4000.
Osram Lightify Home through July 26, 2016, does not use SSL pinning, which may lead to man-in-the-middle attacks.
Osram Lightify Home before July 26, 2016, stores a PSK in cleartext under /private/var/mobile/Containers/Data/Application.
Atlassian JIRA Server before version 7.1.9 has a CSRF vulnerability in auditing/settings.
OpenCV version 3.0.0 has a double free issue that allows attackers to execute arbitrary code.
AXIS Communications products with firmware through 5.80.x allow remote attackers to modify arbitrary files as root via vectors involving Open Script Editor, which is a resource injection vulnerability.
AXIS Communications products are vulnerable to CSRF attacks, as demonstrated by admin/pwdgrp.cgi, vaconfig.cgi, and admin/local_del.cgi.
A stack-based buffer overflow in the havok_write function in havok.c in Amazon Fire OS before January 15, 2016 allows attackers to cause a denial of service (panic) or possibly have unspecified other impact via a long string to /dev/hv.
Dell Integrated Remote Access Controller (iDRAC) 6 before version 2.80 allows remote attackers to execute arbitrary administrative HTTP commands.
Dell Integrated Remote Access Controller (iDRAC) 7/8 before version 2.21.21.21 has an XXE vulnerability.
Dell Integrated Remote Access Controller (iDRAC) 6 before version 2.80 and 7/8 before version 2.21.21.21 is vulnerable to attacks that can lead to denial of service (buffer overflow) or other unspecified impacts via a long SSH username or input.
Dell Integrated Remote Access Controller (iDRAC) 7/8 before version 2.21.21.21 has a format string issue in the racadm getsystinfo command.
Dell Integrated Remote Access Controller (iDRAC) 6 before version 2.80 and 7/8 before version 2.21.21.21 allows directory traversal.