CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An unspecified vulnerability in Apple Safari 7.0.2 on OS X allows remote attackers to execute arbitrary code with root privileges via unknown vectors.
The update process in IBM Security AppScan Standard versions 7.9 through 8.8 does not require integrity checks of downloaded files, allowing remote attackers to execute arbitrary code via a crafted file.
The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors.
The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands via unspecified vectors.
Buffer overflow in MayGion IP Cameras with firmware before 2013.04.22 (05.53) allows remote attackers to execute arbitrary code via a long filename in a GET request.
Microsoft Word w wersjach 2003 SP3, 2007 SP3, 2010 SP1 i SP2, 2013 oraz Word Viewer, a także inne produkty Office, mają lukę, która pozwala zdalnym atakującym na wykonanie dowolnego kodu lub spowodowanie odmowy usługi poprzez spreparowane dane RTF. Luka ta była wykorzystywana w atakach w marcu 2014 roku.
A stack-based buffer overflow in wpsio.dll in Kingsoft WPS Office 2012 allows remote attackers to execute arbitrary code via a long BSTR string.
In the Linux kernel up to version 3.13.6, there is a flaw in net/netfilter/nf_conntrack_proto_dccp.c that incorrectly uses a DCCP header pointer. This can lead to a system crash or potentially allow arbitrary code execution via a malicious DCCP packet.
Siemens SIMATIC S7-1200 CPU PLC devices with firmware before version 4.0 are vulnerable to remote attacks that can lead to denial of service via crafted HTTPS packets.
Siemens SIMATIC S7-1200 CPU PLC devices with firmware before version 4.0 are vulnerable to remote attacks that can lead to denial of service via crafted ISO-TSAP packets.
Siemens SIMATIC S7-1200 CPU PLC devices with firmware before version 4.0 are vulnerable to remote attacks that can lead to denial of service via crafted HTTP packets.
The random-number generator on Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 does not have sufficient entropy, making it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions.
A stack-based buffer overflow in the Taskmaster Capture ActiveX control in IBM Datacap Taskmaster Capture 8.0.1 and 8.1 before FP2 allows remote attackers to execute arbitrary code.
The XSLT component in Apache Camel versions 2.11.x before 2.11.4 and 2.12.x before 2.12.3, and possibly earlier versions, allows remote attackers to execute arbitrary Java methods via a crafted message.
The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
The install script in Domain Technologie Control (DTC) before version 0.34.1 gives sudo permissions for chrootuid to the dtc user, making it easier for context-dependent users to gain privileges.
The drawAdminTools_PackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control (DTC) before version 0.32.11 allows remote attackers to execute arbitrary commands via shell metacharacters in the dtcpkg_directory parameter in a do_install action.
A vulnerability in Cisco IOS 15.1(2)SY3 and earlier, when used with Supervisor Engine 2T on Catalyst 6500 devices, allows remote attackers to cause a device crash via crafted multicast packets.
The End User Safelist/Blocklist (SLBL) service in Cisco AsyncOS Software for Email Security Appliance (ESA) and Cisco Content Security Management Appliance (SMA) before specified versions allows remote authenticated users to execute arbitrary code with root privileges via an FTP session that uploads a modified SLBL database file.
Multiple SQL injection vulnerabilities in MantisBT before version 1.2.16 allow remote attackers to execute arbitrary SQL commands via unspecified parameters in various API functions.