CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c in bmp2tiff in libtiff version 4.0.6 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via a large width field in a BMP image.
The _TIFFVGetField function in tif_dir.c in libtiff 4.0.6 allows attackers to cause a denial of service (invalid memory write and crash) or possibly have unspecified other impact via crafted field data in an extension tag in a TIFF image.
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, allowing remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before version 16.4 does not properly validate serialized XML objects, allowing remote attackers to conduct SQL injection attacks via a crafted SOAP request.
The kernel in Android before version 5.1.1 LMY49F and before January 1, 2016, allows attackers to obtain sensitive information, enabling them to bypass an unspecified protection mechanism. This is demonstrated by obtaining Signature or SignatureOrSystem access.
A vulnerability in mediaserver in Android 5.x before version 5.1.1 LMY49F and 6.0 before January 1, 2016, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
The pcre_compile2 function in PCRE 8.38 mishandles patterns with named subgroups, potentially leading to a heap-based buffer overflow. Remote attackers can exploit this vulnerability by sending a crafted regular expression.
Interfejsy obiektów zserializowanych w niektórych produktach IBM, takich jak analityka, rozwiązania biznesowe, kognitywne, infrastruktura IT oraz produkty mobilne i społeczne, umożliwiają zdalnym atakującym wykonanie dowolnych poleceń za pomocą spreparowanego zserializowanego obiektu Java, związane z klasą InvokerTransformer w bibliotece Apache Commons Collections.
The Data Protection extension in the VMware GUI in IBM Tivoli Storage Manager for Virtual Environments before version 7.1.3.0 and Tivoli Storage FlashCopy Manager for VMware before version 4.1.3.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
Belkin F9K1102 devices with firmware 2.10.17 rely on client-side JavaScript code for authorization, allowing remote attackers to gain administrative privileges through certain changes to LockStatus and Login_Success values.
The web management interface on Belkin F9K1102 devices with firmware 2.10.17 has a blank password, allowing remote attackers to gain administrative privileges by leveraging a LAN session.
The web administration interface on ReadyNet WRT300N-DD devices with firmware 1.0.26 has a default password of 'admin' for the admin account, allowing remote attackers to obtain administrative privileges by leveraging a LAN session.
The web administration interface on Amped Wireless R10000 devices with firmware 2.5.2.11 has a default password of 'admin' for the admin account, allowing remote attackers to gain administrative privileges by leveraging a LAN session.
The diagnostic-ping implementation on ZyXEL PMG5318-B20A devices with firmware before 1.00(AANC.2)C0 allows remote attackers to execute arbitrary commands via the PingIPAddr parameter.
ZyXEL P-660HW-T1, PMG5318-B20A, and NBG-418N devices have a default password of '1234' for the admin account, allowing remote attackers to gain administrative access.
Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 and Tenda N3 Wireless N150 devices allow remote attackers to obtain administrative access via a certain admin substring in an HTTP Cookie header.
Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before version 3.4.1.105 have a default password of 'root' for the root account, allowing remote attackers to gain administrative access via a TELNET session.
Corega CG-WLBARGS devices allow remote attackers to perform administrative operations via unspecified vectors.
ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE have a hardcoded password of 'root' for the root account, allowing remote attackers to gain administrative access via a TELNET session.
Adobe Flash Player versions before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, as well as Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.