CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Use-after-free vulnerability in Adobe Flash Player before version 18.0.0.366 and 19.x through 22.x before version 22.0.0.209 on Windows and OS X and before version 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors.
The j_spring_security_switch_user function in Cisco Unified Intelligence Center (CUIC) versions 8.5.4 through 9.1(1) allows remote attackers to create user accounts by visiting an unspecified web page.
The AAA service in Cisco IOS versions 12.0 through 12.4 and 15.0 through 15.6 and IOS XE versions 2.1 through 3.18 and 16.2 allows remote attackers to cause a denial of service (device reload) via a failed SSH connection attempt that is mishandled during generation of an error-log message.
Cisco IOS versions 12.2 and 15.0 through 15.3 are vulnerable to an attack that can lead to denial of service by sending specially crafted Common Industrial Protocol (CIP) requests.
A memory leak in the Smart Install client implementation in Cisco IOS 12.2 and 15.0 through 15.2 and IOS XE 3.2 through 3.8 allows remote attackers to cause a denial of service via crafted image-list parameters.
Cisco IOS versions 12.0 through 12.4 and 15.0 through 15.6, as well as IOS XE versions 3.1 through 3.15, have a vulnerability in the DNS forwarder that allows remote attackers to obtain sensitive information from process memory or cause a denial of service via a crafted DNS response.
Cisco IOS versions 12.2 and IOS XE from 3.14 to 3.16 and 16.1 contain a vulnerability that allows remote attackers to cause a denial of service via crafted IP Detail Record (IPDR) packets.
Cisco IOS XE versions 3.1 through 3.17 and 16.1 through 16.2 are vulnerable to an attack that can cause device reload via crafted ICMP packets requiring NAT.
Cisco NX-OS versions before 7.0(3)I2(2e) and 7.0(3)I4 before 7.0(3)I4(1) have an incorrect iptables local-interface configuration, allowing remote attackers to obtain sensitive information via TCP or UDP traffic.
A cross-site request forgery (CSRF) vulnerability exists in Cisco FireSIGHT System Software versions 4.10.2 through 6.1.0 and Firepower Management Center. It allows remote attackers to hijack the authentication of arbitrary users.
Cisco IOS versions 12.2 through 15.3 and IOS XE versions 3.1 through 3.9 are vulnerable to an attack that can cause a device restart by sending a crafted MSDP Source-Active (SA) message.
Cisco IOS XE versions 3.1 through 3.17 and 16.1 on 64-bit platforms allow remote attackers to cause a denial of service (data-structure corruption and device reload) via fragmented IPv4 packets.
Cisco IOS versions 12.2 through 12.4 and 15.0 through 15.6, as well as IOS XE versions 3.1 through 3.17 and 16.2, are vulnerable to an attack that can lead to denial of service via crafted fields in an H.323 message.
Cisco IOS versions 15.2 through 15.6 and IOS XE versions 3.6 through 3.17 and 16.1 are vulnerable to an attack that can cause a remote denial of service by a malformed IPv6 PIM register packet.
A vulnerability in Cisco IOS 12.4 and 15.0 through 15.6 and IOS XE 3.1 through 3.18 and 16.1 allows remote attackers to cause a denial of service via fragmented IKEv1 packets, leading to memory consumption or device reload.
Fortinet FortiWLC versions 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 allow administrators to obtain sensitive user credentials by reading the pam.log file.
The rsyncd server in Fortinet FortiWLC versions 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 has a hardcoded rsync account, allowing remote attackers to read or write to arbitrary files via unspecified vectors.
The SCTC_REFRESH_EXPORT_TAB_COMP, SCTC_REFRESH_CHECK_ENV, and SCTC_TMS_MAINTAIN_ALOG functions in the SCTC subpackage in SAP Netweaver 7.40 SP 12 allow remote authenticated users with certain permissions to execute arbitrary commands via a CALL 'SYSTEM' statement.
CVE-2016-7161 involves a heap-based buffer overflow in the .receive callback of xlnx.xps-ethernetlite in QEMU, allowing attackers to execute arbitrary code on the QEMU host via a large ethlite packet.
F5 BIG-IP LTM systems in versions 11.x before 11.2.1 HF16, 11.3.x, 11.4.x before 11.4.1 HF11, 11.5.0, 11.5.1 before HF11, 11.5.2, 11.5.3, 11.5.4 before HF2, 11.6.0 before HF8, 11.6.1 before HF1, 12.0.0 before HF4, and 12.1.0 before HF2 allow remote attackers to modify or extract system configuration files via vectors involving NAT64.