CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Adobe Digital Editions versions 4.5.3 and earlier have an exploitable buffer over-read vulnerability. Successful exploitation could lead to information disclosure.
Adobe Digital Editions versions 4.5.3 and earlier have an exploitable heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.
Adobe Campaign versions 16.4 Build 8724 and earlier have a code injection vulnerability.
The TCP stack in the Linux kernel 3.x does not properly implement a SYN cookie protection mechanism for the case of a fast network connection, allowing remote attackers to cause a denial of service (CPU consumption) by sending many TCP SYN packets.
The ipv4_pktinfo_prepare function in the Linux kernel through version 4.9.9 allows attackers to cause a system crash via crafted system calls or possibly IPv4 traffic with invalid IP options.
An issue was discovered in St. Jude Medical Merlin@home, versions prior to 8.2.2, where the identities of the endpoints for the communication channel between the transmitter and Merlin.net are not verified. This may allow a man-in-the-middle attacker to access or influence communications between the identified endpoints.
An issue was discovered in Smiths-Medical CADD-Solis Medication Safety Software, versions 1.0, 2.0, 3.0, and 3.1, related to the lack of identity verification at communication endpoints. This may allow a man-in-the-middle attacker to gain access to the communication channel between endpoints.
An issue was discovered in Smiths-Medical CADD-Solis Medication Safety Software (versions 1.0, 2.0, 3.0, and 3.1) that allows an authenticated user to gain elevated privileges on the SQL database. This enables modification of drug libraries, addition and deletion of users, and changes to user permissions.
Multiple Cross Site Request Forgery vulnerabilities were discovered in Hanwha Techwin Smart Security Manager Versions 1.5 and prior. The flaws exist within the Redis and Apache Felix Gogo servers, allowing an attacker to gain system level access through specific HTTP Post requests.
Multiple Path Traversal vulnerabilities were discovered in Hanwha Techwin Smart Security Manager Versions 1.5 and prior. The flaws exist within the ActiveMQ Broker service, allowing an attacker to access arbitrary files on the server by issuing specific HTTP requests.
An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter that prevents users from changing their own passwords.
An INFORMATION EXPOSURE flaw was discovered in the BINOM3 Universal Multifunctional Electric Power Quality Meter. This vulnerability can be exploited to gain privileged access to the device.
An issue was discovered in the BINOM3 Universal Multifunctional Electric Power Quality Meter related to the lack of CSRF Token generation per page and/or for sensitive functions. This allows silent execution of unauthorized actions, such as configuration parameter changes.
An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter related to lack of authentication for remote service, allowing access to application setup and configuration.
An uncontrolled search path element (DLL Hijacking) vulnerability has been identified in Winlog Lite and Winlog Pro SCADA Software, versions prior to 3.02.01. Exploitation of this vulnerability could allow an attacker to gain access to the system with the same level of privilege as the application using the malicious DLL.
An issue was discovered on Phoenix Contact mGuard devices updated to Version 8.4.0, where updating the device resets the admin user's password to its default value.
An issue was discovered in Schneider Electric Wonderware Historian 2014 R2 SP1 P01 and earlier related to the creation of logins with default passwords. This can allow a malicious entity to compromise Historian databases.
A SQL injection vulnerability was discovered in Advantech WebAccess Version 8.1. To exploit this vulnerability, an attacker must supply malformed input to the WebAccess software.
An information exposure through server log files vulnerability has been identified in OSIsoft PI Coresight 2016 R2 and earlier versions, and PI Web API 2016 R2 when deployed using the PI AF Services 2016 R2 integrated install kit. This may lead to exposure of service account passwords.
An issue was discovered in Advantech WebAccess Version 8.1 that allows authentication bypass. A malicious user can access pages unrestricted by accessing a specific URL on the web server.