CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, allowing remote attackers to conduct hijacking attacks and bypass ACL checks.
The SPDY/2 codec in Facebook Proxygen before 2015-11-09 truncates a certain field to two bytes, which allows hijacking and injection attacks.
The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass ACL checks via a crafted host value.
Liebert MultiLink Automated Shutdown version 4.2.4 allows local users to gain privileges by replacing the LiebertM executable file.
Castle Rock Computing SNMPc before 2015-12-17 has SQL injection via the sc parameter.
The Summer Baby Zoom Wifi video monitoring system allows remote attackers to gain privileges via manual entry of a Settings URL.
The Summer Baby Zoom Wifi video monitoring system allows remote attackers to bypass authentication, related to the MySnapCam web service.
iBaby M3S has a password of 'admin' for the backdoor admin account.
iBaby M6 allows remote attackers to obtain sensitive information related to the ibabycloud.com service.
Lens Peek-a-View contains default passwords for admin, user, and guest accounts, posing a serious security risk.
Philips In.Sight B120/37 allows remote attackers to obtain sensitive information via a direct request, related to yoics.net URLs, stream.m3u8 URIs, and cam_service_enable.cgi.
The Philips In.Sight B120/37 device has several accounts with default passwords that are easy to guess. Among them are passwords for root, admin, and user accounts, posing a serious security risk.
Gynoii has a password of 'guest' for the guest backdoor account and a password of '12345' for the admin backdoor account, which poses a serious security risk.
The TRENDnet WiFi Baby Cam TV-IP743SIC has a password of 'admin' for the backdoor root account.
Vision Critical before May 30, 2014, allows attackers to read arbitrary files via unspecified vectors, as demonstrated by image files and configuration files.
The Binary File Descriptor (BFD) library in GNU Binutils 2.28 has an undefined behavior issue related to member access within a null pointer, which may lead to application crashes.
The HE-AAC+ Codec (libaacplus) version 2.0.2 has an assertion failure that may allow remote attackers to cause an application crash (denial of service) or potentially have unspecified other impact via a crafted audio file.
The HE-AAC+ Codec (libaacplus) version 2.0.2 has a left-shift undefined behavior issue, which might allow remote attackers to cause application crashes or potentially other unspecified impacts via a crafted audio file.
The au_channel.h file in the HE-AAC+ Codec (libaacplus) version 2.0.2 has a signed integer overflow, which may allow remote attackers to cause application crashes or potentially have unspecified other impacts via a crafted audio file.
LibTIFF version 4.0.7 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.