CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The MoofParser::Metadata function in libstagefright in Mozilla Firefox before version 44.0 does not limit the size of read operations, which may allow remote attackers to cause a denial of service (integer overflow and buffer overflow) or possibly have unspecified other impact via crafted metadata.
The nsZipArchive function in Mozilla Firefox before version 44.0 might allow remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect use of a pointer during processing of a ZIP archive.
The Buffer11::NativeBuffer11::map function in ANGLE, as used in Mozilla Firefox before version 44.0, might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
Mozilla Firefox before 44.0 allows user-assisted remote attackers to spoof a trailing substring in the address bar by leveraging a user's paste of a (1) wyciwyg: URI or (2) resource: URI.
Buffer overflow in the BufferSubData function in Mozilla Firefox before 44.0 and Firefox ESR 38.x before 38.6 allows remote attackers to execute arbitrary code via crafted WebGL content.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before version 44.0 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to uninitialized memory encountered during brotli data compression, and other vectors.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 44.0 and Firefox ESR 38.x before 38.6 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.
HPE Operations Manager versions 8.x and 9.0 on Windows allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
Directory traversal vulnerability in WebManager in NEC EXPRESSCLUSTER X allows remote attackers to read arbitrary files. This affects versions 3.3 11.31 on Windows and 3.3 3.3.1-1 on Linux and Solaris.
A cross-site request forgery (CSRF) vulnerability exists in KDDI HOME SPOT CUBE devices before version 2, allowing remote attackers to hijack the authentication of unspecified victims via unknown vectors.
There is an open redirect vulnerability in KDDI HOME SPOT CUBE devices before version 2 that allows remote attackers to redirect users to arbitrary websites.
CAREL PlantVisorEnhanced allows remote attackers to bypass intended access restrictions via a direct file request.
The web GUI on Cisco Small Business 500 devices version 1.2.0.92 is vulnerable to denial of service attacks via a crafted HTTP request.
Westermo WeOS before version 4.19.0 uses the same SSL private key across different customers' installations, making it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a key.
Intel Driver Update Utility before version 2.4 retrieves driver updates in cleartext, making it easier for man-in-the-middle attackers to execute arbitrary code via a crafted file.
The ConnectionExists function in lib/url.c in libcurl before version 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request.
OpenStack Object Storage (Swift) before 2.3.1 (Kilo), 2.4.x, and 2.5.x before 2.5.1 (Liberty) do not properly close server connections, allowing remote attackers to cause a denial of service via a series of interrupted requests to a Large Object URL.
OpenStack Object Storage (Swift) before version 2.4.0 does not properly close client connections, allowing remote attackers to cause a denial of service via a series of interrupted requests to a Large Object URL.
A stack-based buffer overflow exists in McAfee File Lock 5.x in McPvDrv.sys 4.6.111.0, which can lead to a system crash. Attackers can exploit a long vault GUID in an ioctl call to cause a denial of service.
McPvDrv.sys version 4.6.111.0 in McAfee File Lock 5.x and McAfee Total Protection allows local users to obtain sensitive information from kernel memory or cause a system crash via a large VERIFY_INFORMATION.Length value in an IOCTL_DISK_VERIFY ioctl call.