CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The administrative interface in Allied Telesis AT-RG634A and various firmware versions of iMG624A, iMG616LH, and iMG646BD allows remote attackers to gain privileges and execute arbitrary commands via a direct request to cli.html.
CVE-2014-1645 is an SQL injection vulnerability in forcepasswd.do in the management GUI of Symantec LiveUpdate Administrator (LUA) 2.x before 2.3.2.110. It allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
The forgotten-password feature in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator (LUA) 2.x before version 2.3.2.110 allows remote attackers to reset arbitrary passwords by providing the e-mail address associated with a user account.
A vulnerability in IBM SAN Volume Controller and Storwize V3500, V3700, V5000, and V7000 systems, as well as Flex System V7000, allows remote attackers to gain CLI access. This can lead to denial of service.
Unspecified vulnerability in HP StoreOnce Virtual Storage Appliance (VSA) before version 3.7.2 and in StoreOnce 26xx, 4210 iSCSI, and 4210 FC Backup Systems before version 3.9.0, as well as in StoreOnce 4xxx Backup Systems before version 3.9.0, allows remote attackers to obtain sensitive information or cause a denial of service via unknown vectors.
Heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 allows remote attackers to execute arbitrary code via a crafted request.
A vulnerability in Cisco IOS and IOS XE allows remote attackers to cause a denial of service by sending a malformed IPv6 packet, leading to I/O memory consumption and device reload.
The SSL VPN feature in Cisco IOS versions 15.1 through 15.4 allows remote attackers to cause a denial of service (memory consumption) via crafted HTTP requests.
The Application Layer Gateway (ALG) module in Cisco IOS versions 12.2 through 12.4 and 15.0 through 15.4, when NAT is used, allows remote attackers to cause a denial of service (device reload) via crafted DNS packets.
The TCP Input module in Cisco IOS versions 12.2 through 12.4 and 15.0 through 15.4, when NAT is used, allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted TCP packets.
Cisco IOS versions 12.2 and 15.0 through 15.3 and IOS XE 3.2 through 3.7 before 3.7.5S and 3.8 through 3.10 before 3.10.1S are vulnerable to an attack that can cause a device reload via a malformed IKEv2 packet.
A vulnerability in Cisco IOS 12.2 and 15.0 through 15.3, when used with Kailash FPGA before version 2.6 on RSP720-3C-10GE and RSP720-3CXL-10GE devices, allows remote attackers to cause a denial of service (route switch processor outage) via crafted IP packets.
Cisco IOS 15.3M before 15.3(3)M2 and IOS XE 3.10.xS before 3.10.2S are vulnerable to remote attacks that can cause device reload via crafted SIP messages.
A stack-based buffer overflow in Artweaver Plus and Free before version 3.1.5 allows remote attackers to execute arbitrary code via a crafted JPG image file.
Heap-based buffer overflow in PDFCore8.dll in Nuance PDF Reader before 8.1 allows remote attackers to execute arbitrary code via crafted font table directory values in a TTF file, related to naming table entries.
Adobe Reader version 11.0.06 allows attackers to bypass a PDF sandbox protection mechanism via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014.
A heap-based buffer overflow in Adobe Reader 11.0.06 allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014.
A heap-based buffer overflow in Adobe Flash Player 12.0.0.77 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors.
A use-after-free vulnerability in Adobe Flash Player before version 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X, and before 11.2.202.350 on Linux, as well as in Adobe AIR before 13.0.0.83 on Android, allows remote attackers to execute arbitrary code.
A heap-based buffer overflow in Apple Safari 7.0.2 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism.