CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Reader and Acrobat before version 11.0.16, and Acrobat and Acrobat Reader DC Classic before 15.006.30172, as well as Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
The web UI in Red Hat CloudForms 4.1 allows remote authenticated users to execute arbitrary code due to a lack of field filters.
Virtual servers in F5 BIG-IP systems in versions 11.2.1 HF11 through HF15, 11.4.1 HF4 through HF10, 11.5.3 through 11.5.4, 11.6.0 HF5 through HF7, and 12.0.0, when configured with a TCP profile, allow remote attackers to cause a denial of service via crafted network traffic.
Cisco AnyConnect Secure Mobility Client before 4.2.05015 and 4.3.x before 4.3.02039 mishandles pathnames, allowing local users to gain privileges via a crafted INF file.
A stack-based buffer overflow in dws/api/Login on D-Link DIR-850L B1, DIR-817 Ax, DIR-818LW Bx, DIR-822 C1, DIR-823 A1, DIR-895L A1, DIR-890L A1, DIR-885L A1, DIR-880L A1, and DIR-868L B1 and C1 devices before specified firmware versions allows remote attackers to execute arbitrary code via a long session cookie.
UltraVNC Repeater before 1300 does not restrict destination IP addresses or TCP ports, allowing remote attackers to obtain open-proxy functionality by using a :: substring between the IP address and port number.
WebKit w systemie iOS firmy Apple przed wersją 9.3.5 pozwala zdalnym atakującym na wykonanie dowolnego kodu lub spowodowanie odmowy usługi (uszkodzenie pamięci) poprzez specjalnie przygotowaną stronę internetową.
Jądro systemu Apple iOS przed wersją 9.3.5 umożliwia atakującym wykonanie dowolnego kodu w kontekście z uprawnieniami lub spowodowanie odmowy usługi (uszkodzenie pamięci) za pomocą spreparowanej aplikacji.
The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.
CVE-2016-4069 in Roundcube Webmail before version 1.1.5 has a cross-site request forgery (CSRF) vulnerability that allows remote attackers to hijack user authentication for requests that download attachments. This can lead to denial of service through unspecified vectors.
WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifconfig command.
Buffer overflow in the Cookie parser in Fortinet FortiOS before version 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9 and FortiSwitch before 3.4.3 allows remote attackers to execute arbitrary code via a crafted HTTP request.
Moxa OnCell G3100V2 devices before version 2.8 and G3111, G3151, G3211, and G3251 devices before version 1.7 do not properly restrict authentication attempts, making it easier for remote attackers to gain access via a brute-force attack.
ZModo ZP-NE14-S and ZP-IBH-13W devices do not enforce a WPA2 configuration setting, allowing remote attackers to associate with an arbitrary access point using a recognized SSID value.
Urządzenia Rockwell Automation MicroLogix 1400 PLC mają wbudowaną, twardo zakodowaną społeczność SNMP, co ułatwia zdalnym atakującym ładowanie dowolnych aktualizacji oprogramowania. Wykorzystanie tej społeczności może prowadzić do nieautoryzowanych zmian w oprogramowaniu urządzenia.
ZModo ZP-NE14-S and ZP-IBH-13W devices have a hardcoded root password, which makes it easier for remote attackers to obtain access via a TELNET session.
The User Data Services (UDS) API implementation in Cisco Unified Communications Manager 11.5 allows remote attackers to bypass intended access restrictions and obtain sensitive information via unspecified API calls.
A memory leak in Cisco IOS XR versions 5.1.x through 5.1.3, 5.2.x through 5.2.5, and 5.3.x through 5.3.2 on ASR 9001 devices allows remote attackers to cause a denial of service (control-plane protocol outage) via crafted fragmented packets.
Cisco WebEx Meetings Server version 2.6 allows remote attackers to bypass intended access restrictions and obtain sensitive application information via unspecified vectors.