CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple heap-based buffer overflows in 3S-Smart CODESYS Gateway Server before version 2.3.9.34 allow remote attackers to execute arbitrary code via opcode (1) 0x3ef or (2) 0x3f0.
CVE-2015-6459 describes a vulnerability in the download feature in FileDownloadServlet in GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before version 3.1.5. It allows remote attackers to read or delete arbitrary files via a full pathname.
MDS PulseNET and MDS PulseNET Enterprise before version 3.1.5 have hardcoded credentials for a support account, allowing remote attackers to gain administrative access and execute arbitrary code.
Cisco Prime Network Registrar (CPNR) versions 8.1(3.3), 8.2(3), and 8.3(2) has a default account that allows local users to gain root access by leveraging knowledge of the credentials.
Buffer overflow in Boxoft WAV to MP3 Converter allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted WAV file.
SQL injection vulnerability in the BP_FIND_JOBS_WITH_PROGRAM function module in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Multiple unspecified vulnerabilities in Twisted in Wiki Server in Apple OS X Server before 5.0.3 allow attackers to have an unknown impact via an XML document.
The kernel in Apple iOS before version 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
libpthread in the kernel in Apple iOS before 9 has a vulnerability that allows local users to gain privileges or cause a denial of service via unspecified vectors.
The kernel in Apple iOS before version 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
Multiple unspecified vulnerabilities in SQLite before version 3.8.10.2, as used in Apple iOS before version 9, may lead to unknown impact and attack vectors.
The processor_set_tasks API implementation in Apple iOS before version 9 allows local users to bypass an entitlement protection mechanism and gain access to the task ports of arbitrary processes by leveraging root privileges.
A vulnerability in dyld in Apple iOS Dev Tools before version 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CoreText in Apple iOS before 9 and iTunes before 12.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file.
The kernel in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
IOHIDFamily in Apple iOS before version 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
IOAcceleratorFamily in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
The Disk Images component in Apple iOS before version 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
IOKit in the kernel in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
IOKit in the kernel in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.