CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in Cisco IOS XR Software allows an authenticated, local attacker to log in to the device with root user privileges.
A vulnerability in the Decrypt for End-User Notification configuration parameter of Cisco AsyncOS Software for Cisco Web Security Appliances could allow an unauthenticated, remote attacker to connect to a secure website over SSL or TLS, even if the WSA is configured to block connections to the website.
A vulnerability in TCP port management in Cisco ONS 15454 Series Multiservice Provisioning Platforms could allow an unauthenticated, remote attacker to cause the controller card to unexpectedly reload.
A vulnerability in the Cisco Unified Reporting upload tool accessed via the Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to modify arbitrary files on the file system.
A vulnerability in the HTTP 2.0 request handling code of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the Event Management Service daemon (emsd) to crash, resulting in a denial of service (DoS) condition.
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) feature of Cisco ASR 5000 Series Software could allow an unauthenticated, remote attacker to cause a reload of the ipsecmgr process.
A vulnerability in the Zone-Based Firewall feature of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to pass traffic that should otherwise have been dropped based on the configuration.
A vulnerability in the Active Directory integration component of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to perform a denial of service (DoS) attack.
A vulnerability in the malicious file detection and blocking features of Cisco Firepower Management Center and Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass malware detection mechanisms on an affected system.
A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to install and execute an arbitrary executable file with privileges equivalent to the Microsoft Windows operating system SYSTEM account.
A vulnerability in the implementation of X.509 Version 3 for SSH authentication functionality in Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to bypass authentication on an affected system.
A vulnerability in the installation procedure of the Cisco Hybrid Media Service allows an authenticated, local attacker to elevate privileges to the root level.
A vulnerability in HTTP URL parsing of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) vulnerability due to the proxy process unexpectedly restarting.
A vulnerability in the web-based management interface of Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device.
A vulnerability in IPv6 packet fragment reassembly of StarOS for Cisco ASR 5000 Series Router could allow an unauthenticated, remote attacker to cause an unexpected reload of the Network Processing Unit (NPU) process.
A vulnerability in the web management interface of the Cisco Unified Communications Manager IM and Presence Service could allow an unauthenticated, remote attacker to view information on web pages that should be restricted.
A vulnerability in the system management of certain FireAMP processes in Cisco FireAMP Connector Endpoint software allows an authenticated, local attacker to stop certain protected FireAMP processes without requiring a password. Stopping critical processes could lead to a denial of service (DoS) condition and loss of certain security features.
CVE-2016-2334 describes a heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before version 16.00 and p7zip. This allows remote attackers to execute arbitrary code via a crafted HFS+ image.
A vulnerability in mysqld_safe in Oracle MySQL and other databases allows local users with access to the mysql account to gain root privileges via a symlink attack on error logs and possibly other files.
A race condition vulnerability exists in Oracle MySQL, MariaDB, Percona Server, and Percona XtraDB Cluster that allows local users with certain permissions to gain elevated privileges. The issue involves the use of my_copystat during REPAIR TABLE on a MyISAM table.