CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple cross-site request forgery (CSRF) vulnerabilities in the DIGISOL DG-HR1400 Wireless Router with firmware 1.00.02 allow remote attackers to hijack the authentication of administrators for requests that change the SSID or Wi-Fi password.
The Plug-in for VMware vCenter in VCE Vision Intelligent Operations before version 2.6.5 sends a cleartext HTTP response upon a request for the Settings screen, allowing remote attackers to discover the admin user password by sniffing the network.
A SQL injection vulnerability was discovered in the Mail Masta plugin version 1.0 for WordPress, identified in the file /inc/campaign_save.php. It requires authentication to the WordPress admin panel and utilizes the POST parameter: list_id.
The Mail Masta plugin (also known as mail-masta) version 1.0 for WordPress has a SQL injection issue. This issue affects the /inc/campaign/count_of_send.php file and requires authentication to the WordPress admin panel, using the POST parameter: camp_id.
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability. The issue occurs in the /inc/lists/view-list.php file, which requires authentication to the WordPress admin panel, using the GET parameter: filter_list.
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability in the /inc/lists/csvexport.php file. This issue affects unauthenticated access using the GET parameter: list_id.
CMS Made Simple version 1.x before 0.8.1.6 allows remote attackers to execute PHP code via the cntnt01fbrp_forma_form_template parameter in admin_store_form.
In GeniXCMS before version 1.0.2, there is a vulnerability that allows CSRF token bypass, potentially leading to privilege escalation. The forgotpassword.php page can be used to acquire a token.
GOM Player version 2.3.10.5266 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted fpx file.
CVE-2016-9315 identifies a privilege escalation vulnerability in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) version 6.5-SP2_Build_Linux_1707 and earlier. It allows authenticated, remote users with least privileges to change the Master Admin's password and/or add new admin accounts.
In Trend Micro InterScan Web Security Virtual Appliance (IWSVA) version 6.5-SP2_Build_Linux_1707 and earlier, a vulnerability allows authenticated, remote users with least privileges to back up the system configuration and download it to their local machine. The backup file contains sensitive information such as passwd/shadow files, RSA certificates, Private Keys, and Default Passphrase.
Trend Micro Interscan Web Security Virtual Appliance (IWSVA) version 6.5-SP2_Build_Linux_1707 and earlier has a remote command execution vulnerability. Authenticated users with least privileges can run arbitrary commands on the system as root via the Patch Update functionality.
Zyxel USG50 Security Appliance and NWA3560-N Access Point allow remote attackers to cause a denial of service by flooding with ICMPv4 Port Unreachable packets, leading to high CPU consumption.
An issue was discovered in certain Apple products, including GarageBand before version 10.1.6, related to the 'Projects' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted GarageBand project file.
An issue was discovered in certain Apple products, including iOS before 10.2.1, Safari before 10.0.3, and tvOS before 10.1.1. The issue involves the 'WebKit' component and allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website.
An issue was discovered in certain Apple products, including GarageBand before 10.1.5 and Logic Pro X before 10.3, related to the 'Projects' component. This allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted GarageBand project file.
An issue was discovered in certain Apple products related to the 'Kernel' component. Affected systems include iOS before 10.2.1, macOS before 10.12.3, tvOS before 10.1.1, and watchOS before 3.1.3. This issue allows attackers to execute arbitrary code in a privileged context or cause a denial of service (buffer overflow) via a crafted app.
An issue was discovered in certain Apple products affecting iOS before 10.2.1, Safari before 10.0.3, and tvOS before 10.1.1. The issue involves the 'WebKit' component and allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website.
An issue was discovered in certain Apple products, including iOS before 10.2.1, Safari before 10.0.3, iCloud before 6.1.1, and iTunes before 12.5.5, involving the 'WebKit' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.
An issue was discovered in certain Apple products affecting iOS before 10.2.1, Safari before 10.0.3, and tvOS before 10.1.1. The issue involves the 'WebKit' component and allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.