CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Cisco WebEx Meetings Player T29.10, when WRF file support is enabled, allows remote attackers to execute arbitrary code via a crafted file.
Malware Information Sharing Platform (MISP) before 2.3.90 is vulnerable to PHP object injection attacks via crafted serialized data, related to TemplatesController.php and populate_event_from_template_attributes.ctp.
Multiple cross-site scripting (XSS) vulnerabilities in the template-creation feature in Malware Information Sharing Platform (MISP) before version 2.3.90 allow remote attackers to inject arbitrary web scripts or HTML via vectors involving (1) add.ctp, (2) edit.ctp, and (3) ajaxification.js.
In MISP versions before 2.3.92, the file app/Controller/TemplatesController.php does not properly restrict filenames under the tmp/files/ directory, which may lead to unspecified impacts and attack vectors.
A cross-site request forgery (CSRF) vulnerability in the admin web interface in GNU Mailman before version 2.1.15 allows remote attackers to hijack the authentication of administrators.
CVE-2016-6893 is a CSRF vulnerability in the user options page in GNU Mailman 2.1.x before version 2.1.23, allowing remote attackers to hijack the authentication of arbitrary users for requests that modify an option.
MQCLI on IBM MQ Appliance M2000 and M2001 devices allows local users to execute arbitrary shell commands via a crafted (1) Disaster Recovery or (2) High Availability command.
Integer overflow in the get_data function in zipimport.c in CPython before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow.
The media-file upload feature in vBulletin before certain versions allows remote attackers to conduct SSRF attacks via a crafted URL, resulting in a Redirection HTTP status code.
AKABEi SOFT2 games allow remote attackers to execute arbitrary OS commands via crafted saved data, as demonstrated by Happy Wardrobe.
Cisco Small Business 220 devices with firmware before 1.0.1.1 have a hardcoded SNMP community, allowing remote attackers to read or modify SNMP objects by leveraging knowledge of this community.
The web-based management interface on Cisco Small Business 220 devices with firmware before 1.0.1.1 is vulnerable to remote attacks that can lead to denial of service via a crafted HTTP request.
CVE-2016-1470 describes a Cross-site request forgery (CSRF) vulnerability in the web-based management interface on Cisco Small Business 220 devices with firmware before version 1.0.1.1. This allows remote attackers to hijack the authentication of arbitrary users.
The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via a crafted OOXML spreadsheet containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Szyfry DES i Triple DES, używane w protokołach TLS, SSH i IPSec, mają ograniczenie urodzinowe wynoszące około czterech miliardów bloków. Umożliwia to zdalnym atakującym uzyskanie danych w postaci niezaszyfrowanej za pomocą ataku urodzinowego na długotrwałą sesję szyfrowaną, znanego jako atak 'Sweet32'.
A stack-based buffer overflow exists in NUUO NVRmini 2 versions 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance version 1.1.2 in cgi-bin/cgi_main. This allows remote authenticated users to execute arbitrary code via the sn parameter to the transfer_license command.
In NUUO NVRmini 2 versions 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance version 1.1.2, remote authenticated users can execute arbitrary commands via shell metacharacters in the sn parameter to the transfer_license command.
NUUO NVRmini 2 versions 1.0.0 through 3.0.0 and NUUO NVRsolo versions 1.0.0 through 3.0.0 have hardcoded root credentials, allowing remote attackers to gain administrative access via unspecified vectors.
NUUO NVRmini 2 versions 1.7.5 through 3.0.0, NUUO NVRsolo versions 1.0.0 through 3.0.0, and NETGEAR ReadyNAS Surveillance versions 1.1.1 through 1.4.1 have a hardcoded password qwe23622260 for the nuuoeng account, allowing remote attackers to obtain sensitive information via an __nvr_status___.php request.
In NUUO NVRmini 2 versions 1.7.5 through 2.x, NUUO NVRsolo versions 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance versions 1.1.1 through 1.4.1, a vulnerability allows remote attackers to reset the administrator password via a cmd=loaddefconfig action.