CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Cisco IOS XE versions 2.1.0 through 2.2.3 and 2.3.0 on ASR 1000 devices, when NAT Application Layer Gateway is used, allow remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted H.323 packet.
Cisco IOS XE versions 2.1.0 through 2.4.3 and 2.5.0 on ASR 1000 devices, when using NAT Application Layer Gateway, allow remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted SIP packet.
Cisco IOS XE before version 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted IPv6 packet.
Cisco IOS XE before version 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted (1) IPv4 or (2) IPv6 packet.
Array index error in the tcm_vhost_make_tpg function in the Linux kernel before version 4.0 may allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl call.
Unspecified vulnerability in HP Intelligent Provisioning versions 1.00 through 1.62(a), 2.00, and 2.10 allows remote attackers to execute arbitrary code via unknown vectors.
Check_MK versions 1.2.2p2, 1.2.2p3, and 1.2.3i5 allow remote authenticated users to execute arbitrary Python code via a crafted rules.mk file in a snapshot.
Buffer overflow in Ricoh DL FTP Server 1.1.0.6 and earlier allows remote attackers to execute arbitrary code via a long USER command.
The udp_recvmsg and udpv6_recvmsg functions in the Linux kernel before version 4.0.6 do not properly consider yielding a processor, allowing remote attackers to cause a denial of service (system hang) via incorrect checksums within a UDP packet flood.
In the Linux kernel before version 4.1.6 on the x86_64 platform, there is a flaw in handling IRET faults during NMI processing that occurred during userspace execution. This may allow local users to gain privileges by triggering an NMI.
In the Linux kernel before version 4.1.6 on the x86_64 platform, there is a flaw in entry_64.S that improperly relies on espfix64 during nested NMI processing. This allows local users to gain privileges by triggering an NMI within a certain instruction window.
A cross-site request forgery (CSRF) vulnerability exists in Siemens SIMATIC S7-1200 CPU devices with firmware prior to version 4.1.3. This allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Buffer overflow in the HTTP administrative interface in TIBCO Rendezvous before version 8.4.4, Rendezvous Network Server before 1.1.1, Substation ES before 2.9.0, and Messaging Appliance before 8.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code.
The add-on installation feature in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to bypass an intended user-confirmation requirement by constructing a crafted data: URL and triggering navigation to an arbitrary http: or https: URL at a certain early point in the installation process.
A use-after-free vulnerability in the CanvasRenderingContext2D implementation in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to execute arbitrary code. The issue arises from improper interaction between resize events and changes to CSS token sequences for a CANVAS element.
Cisco IOS XE before version 3.1.2S on ASR 1000 devices mishandles the automatic setup of Virtual Fragment Reassembly (VFR) by certain firewall and NAT components, allowing remote attackers to cause a denial of service (Embedded Services Processor crash) via crafted IP packets.
Cisco IOS XE before version 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted IPv4 UDP packet.
Cisco IOS XE before version 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service via a crafted L2TP packet, leading to an Embedded Services Processor crash.
A stack-based buffer overflow in GSM SIM Utility (also known as SIM Card Editor) version 6.6 allows remote attackers to execute arbitrary code via a long entry in a .sms file.
Buffer overflow in CHICKEN versions 4.9.0.x before 4.9.0.2, 4.9.x before 4.9.1, and before 5.0 allows attackers to have unspecified impact via a positive START argument to the 'substring-index[-ci] procedures.'