CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 is vulnerable to remote attacks that can lead to denial of service by sending crafted packets.
The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 is vulnerable to remote attacks that can lead to denial of service by sending crafted packets.
The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 is vulnerable to remote attacks that can lead to denial of service by sending crafted packets.
Cisco TelePresence System MXP Series Software before F9.3.1 is vulnerable to an attack that can lead to denial of service by sending crafted SIP packets.
Cisco TelePresence System MXP Series Software before F9.3.1 is vulnerable to an attack that can lead to denial of service by sending crafted SIP packets.
Cisco TelePresence System MXP Series Software before F9.3.1 is vulnerable to an attack that can lead to denial of service by sending crafted SIP packets.
Unspecified vulnerability in the management GUI in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 9.3-66.5 and 10.x before 10.1-122.17, related to certificate validation.
Unspecified vulnerability in the Diffie-Hellman key agreement implementation in the management GUI Java applet in Citrix NetScaler ADC and NetScaler Gateway before version 9.3-66.5 and 10.x before version 10.1-122.17.
Ecava IntegraXor before 4.1.4393 allows remote attackers to read cleartext credentials for administrative accounts via SELECT statements that leverage the guest role.
In version 3.30.0 of Super, the super.c file does not check the return value of the setuid function when the -F flag is set. This allows local users to gain privileges via unspecified vectors, known as an RLIMIT_NPROC attack.
FortiAuthenticator before 3.0 allows remote administrators to gain privileges via the command line interface.
A use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox before version 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to host resolution.
A use-after-free vulnerability in the nsGenericHTMLElement::GetWidthHeightForImage function in Mozilla Firefox, Thunderbird, and SeaMonkey before specified versions allows remote attackers to execute arbitrary code or cause a denial of service through improper handling of an imgLoader object during an image-resize operation.
The Web Notification API in Mozilla Firefox, Thunderbird, and SeaMonkey before specified versions allows remote attackers to bypass source-component restrictions and execute arbitrary JavaScript code in a privileged context via a crafted web page.
The sse2_composite_src_x888_8888 function in the Pixman library, used in Mozilla Firefox 28.0 and SeaMonkey 2.25 on Windows, allows remote attackers to execute arbitrary code or cause application crashes by painting on a CANVAS element.
The mozilla::dom::TextTrack::AddCue function in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 does not properly perform garbage collection for Text Track Manager variables, allowing remote attackers to execute arbitrary code or cause a denial of service via a crafted VIDEO element in an HTML document.
The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 does not properly check whether objects are XBL objects. This allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted JavaScript code.
The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service via crafted content.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.