CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site.
In Drupal 8.2.x versions before 8.2.7, when adding a private file via the editor, access permissions for the attached file are not correctly checked, leading to an access bypass.
A stack-based buffer overflow vulnerability has been identified in the Fatek Automation PLC Ethernet Module, which may allow remote code execution or crash the affected device. This affects the Ether_cfg software configuration tool running on specific Fatek PLC versions.
A vulnerability in the mesh code of Cisco Wireless LAN Controller (WLC) software could allow an unauthenticated, remote attacker to impersonate a WLC in a meshed topology. The vulnerability is due to insufficient authentication of the parent access point in a mesh configuration.
A vulnerability in the Client Manager Server of Cisco Workload Automation and Cisco Tidal Enterprise Scheduler could allow an unauthenticated, remote attacker to retrieve any file from the Client Manager Server. The vulnerability is due to insufficient input validation.
A vulnerability in the web-based GUI of Cisco Mobility Express 1800 Series Access Points could allow an unauthenticated, remote attacker to bypass authentication. The attacker could be granted full administrator privileges.
A privilege escalation vulnerability in the Secure Shell (SSH) subsystem in the StarOS operating system for Cisco ASR 5000, ASR 5500, ASR 5700 Series devices, and Cisco Virtualized Packet Core could allow an authenticated, remote attacker to gain unrestricted, root shell access.
The gnuplot delegate functionality in ImageMagick before version 6.9.4-0 and in GraphicsMagick allows remote attackers to execute arbitrary commands via unspecified vectors.
Integer overflow in the strxfrm function in the GNU C Library (glibc or libc6) before version 2.21 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, leading to a stack-based buffer overflow.
Integer overflow in coders/icon.c in ImageMagick 6.9.1-3 and later allows remote attackers to cause a denial of service (application crash) via a crafted length value, which triggers a buffer overflow.
CSRF exists in BigTree CMS versions 4.1.18 and 4.2.16, allowing a user to be deleted via the admin/ajax/users/delete/ page with the id parameter.
A stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving WFS get feature requests.
The logcheck function in session.inc in AlienVault OSSIM before 5.3.1 and USM before 5.3.1 allows remote attackers to bypass authentication, consequently obtaining sensitive information, modifying the application, or executing arbitrary code as root via an 'AV Report Scheduler' HTTP User-Agent header.
Buffer overflow in the tcpcapinfo utility in Tcpreplay before version 4.2.0 Beta 1 allows remote attackers to have unspecified impact via a pcap file with an over-size packet.
An untrusted search path vulnerability in Amazon Kindle for PC before version 1.19 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse DLL in the current working directory of the Kindle Setup installer.
The parse_instruction function in tgsi_text.c in virglrenderer before version 0.6.0 allows local guest OS users to cause a denial of service through out-of-bounds array access, leading to process crash.
Sawmill Enterprise version 8.7.9 allows remote attackers to gain login access by leveraging knowledge of a password hash.
EasyCom SQL iPlug allows remote attackers to cause a denial of service via the D$EVAL parameter to the default URI.
Stack-based buffer overflows in php_Easycom5_3_0.dll in EasyCom for PHP 4.0.0.29 allow remote attackers to execute arbitrary code via the server argument to the (1) i5_connect, (2) i5_pconnect, or (3) i5_private_connect API function.
The search_make_new function in evdns.c in libevent before version 2.1.6-beta allows attackers to cause a denial of service (out-of-bounds read) via an empty hostname.