CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in the built-in web server in DiskSavvy Enterprise 9.4.18 allows remote attackers to execute arbitrary code via a long URI in a GET request.
Podatność CVE-2017-6077 dotyczy urządzeń NETGEAR DGN2200 z firmware do wersji 10.0.0.50, gdzie zdalni uwierzytelnieni użytkownicy mogą wykonywać dowolne polecenia systemowe poprzez wykorzystanie metaznaków powłoki w polu ping_IPAddr w żądaniu HTTP POST.
A stack-based buffer overflow vulnerability was discovered in the zebra daemon in Quagga before version 1.0.20161017 when processing IPv6 Neighbor Discovery messages. The root cause was relying on BUFSIZ, which is system-dependent, leading to message size incompatibility.
OpenText Documentum D2 version 4.x allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the BeanShell (bsh) and Apache Commons Collections (ACC) libraries.
Vulnerability in OpenText Documentum Content Server 7.3, when using PostgreSQL Database and the return_top_results_row_based config option is set to false, allows improper restriction of DQL hints. This enables remote authenticated users to conduct DQL injection attacks and execute arbitrary DML or DDL commands via a crafted request.
The route manager in FlightGear before version 2016.4.4 allows remote attackers to write to arbitrary files via a crafted Nasal script.
The CClient::ProcessServerPacket method in Teeworlds before version 0.6.4 allows remote servers to write to arbitrary physical memory locations, potentially leading to arbitrary code execution.
Integer overflow in the mem_check_range function in the Linux kernel before version 4.9.10 allows local users to cause a denial of service (memory corruption) and obtain sensitive information from kernel memory.
The installPackage function in the installerHelper subcomponent in Libmacgpg in GPG Suite before version 2015.06 allows local users to execute arbitrary commands with root privileges via shell metacharacters in the xmlPath argument.
The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerability in its web administrative interface. This vulnerability occurs in the 'viewcert' CGI component responsible for processing SSL certificate information.
The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerability in its web administrative interface. This vulnerability occurs in the 'extensionsettings' CGI component, which improperly processes input data, allowing for remote command execution.
The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to two Remote Command Injection vulnerabilities in its web administrative interface. These vulnerabilities occur in the diagnostics CGI component, allowing for remote command injection.
A vulnerability in the web interface of the Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to disclose sensitive information.
An HTTP Packet Processing vulnerability in the Web Bridge interface of the Cisco Meeting Server (CMS) could allow an authenticated, remote attacker to retrieve memory contents, potentially leading to the disclosure of confidential information. The attacker could also cause the application to crash unexpectedly, resulting in a denial of service (DoS) condition.
A vulnerability in the sponsor portal of Cisco Identity Services Engine (ISE) allows an authenticated, remote attacker to access notices owned by other users due to SQL Injection.
A vulnerability in an internal API of the Cisco Meeting Server (CMS) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the affected appliance.
Siemens SIMATIC Logon prior to V1.5 SP3 Update 2 could allow an attacker with knowledge of a valid user name, and physical or network access to the affected system, to bypass the application-level authentication.
An out-of-bounds indexing vulnerability exists within the RW fabric message particle type of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause the server to fetch a function table outside the bounds of an array, resulting in remote code execution.
An out-of-bounds write vulnerability exists in the batch transaction field parsing functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause an out-of-bounds write resulting in memory corruption and potentially lead to remote code execution.
An exploitable denial-of-service vulnerability exists in the fabric-worker component of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause the server process to dereference a null pointer.