CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
F5 SSL Intercept iApp versions 1.5.0 - 1.5.7 is vulnerable to an unauthenticated remote attack that may allow modification of the BIG-IP system configuration, extraction of sensitive system files, and possible remote command execution on the system when deployed using the Explicit Proxy feature plus SNAT Auto Map option for egress traffic.
AIRTAME HDMI dongle with firmware before version 2.2.0 allows unauthenticated access to a large part of the management interface. It is possible to extract all information including the Wi-Fi password, reboot the device, or force a software update at any time.
HelpDEZk version 1.1.1 has a CSRF vulnerability in admin/home#/logos/, which can lead to remote execution of arbitrary PHP code.
HelpDEZk version 1.1.1 has a CSRF vulnerability in the path admin/home#/person/, allowing for the acquisition of admin privileges.
In Veritas System Recovery before version 16 SP1, there is a DLL hijacking vulnerability in the patch installer if an attacker has write access to the directory from which the product is executed.
IBM Disposal and Governance Management and IBM Global Retention Policy and Schedule Management version 6.0.3 are vulnerable to cross-site request forgery, allowing an attacker to execute malicious and unauthorized actions on behalf of a trusted user.
FreeRADIUS versions 2.2.x before 2.2.8 and 3.0.x before 3.0.9 do not properly check revocation of intermediate CA certificates.
Blue Coat Advanced Secure Gateway (ASG) version 6.6 before 6.6.5.4 and Content Analysis System (CAS) version 1.3 before 1.3.7.4 are susceptible to an OS command injection vulnerability. An authenticated malicious administrator can execute arbitrary OS commands with elevated system privileges.
On the Broadcom Wi-Fi HardMAC SoC with fbt firmware, a stack buffer overflow occurs when handling an 802.11r (FT) authentication response, leading to remote code execution via a crafted access point that sends a long R0KH-ID field in a Fast BSS Transition Information Element (FT-IE).
A vulnerability in the NVIDIA crypto driver allows a local malicious application to execute arbitrary code within the context of the kernel. It requires compromising a privileged process first.
CVE-2017-0332 is a vulnerability in the NVIDIA crypto driver that allows a local malicious application to execute arbitrary code within the kernel context. This issue is rated as High because it requires compromising a privileged process first.
CVE-2017-0329 describes an elevation of privilege vulnerability in the NVIDIA boot and power management processor driver, allowing a local malicious application to execute arbitrary code within the context of the processor. This issue is rated as High because it first requires compromising a privileged process.
A vulnerability in the NVIDIA crypto driver allows a local malicious application to execute arbitrary code within the context of the kernel. It requires first compromising a privileged process.
A vulnerability in the NVIDIA I2C HID driver allows a local malicious application to execute arbitrary code within the kernel context, potentially leading to privilege escalation.
In LightDM through version 1.22.0, a directory traversal issue in debian/guest-account.sh allows local attackers to own arbitrary directory path locations and escalate privileges to root when the guest user logs out.
Apache Geode before version 1.1.1, when security is enabled, allows remote authenticated users with CLUSTER:READ but not DATA:READ permission to access the data browser page in Pulse, consequently executing an OQL query that exposes data stored in the cluster.
The msm_ipc_router_close function in the ipc_router component of Linux kernel 3.x can lead to denial of service through NULL pointer dereference. Attackers can trigger a failure during the accept system call for an AF_MSM_IPC socket.
A heap-based buffer overflow in the CreateFXPDFConvertor function in ConvertToPdf_x86.dll in Foxit Reader 7.3.4.311 allows remote attackers to execute arbitrary code via a large SamplesPerPixel value in a crafted TIFF image that is mishandled during PDF conversion.
The OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology, affecting the flow of data. This issue is related to the reuse of LLDP packets, known as 'LLDP Relay.'
OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to 'fake LLDP injection.'