CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An XML External Entity (XXE) issue exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET), exploitable by sending a crafted standard-conforming OSCI message from within the infrastructure.
A Weak Cryptography for Passwords issue was discovered in General Electric (GE) Multilin SR 750, SR 760, SR 469, SR 489, SR 745, SR 369, and Multilin Universal Relay and URplus devices. Firmware versions prior to specified versions are susceptible to dictionary attacks due to the use of a non-random initialization vector.
W urządzeniach sterujących Rockwell Automation Allen-Bradley MicroLogix 1100 i MicroLogix 1400 zidentyfikowano problem związany z słabymi wymaganiami dotyczącymi haseł. Dotyczy to wersji 16.00 i wcześniejszych, które używają numerycznego hasła o małej maksymalnej długości.
A 'Reusing a Nonce, Key Pair in Encryption' issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers. Exploiting this vulnerability may allow an attacker to capture and replay a valid request until the nonce is changed.
An Information Exposure issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400 devices, where user credentials are sent to the web server using the HTTP GET method, potentially leading to their logging.
W urządzeniach sterujących Rockwell Automation Allen-Bradley MicroLogix 1100 i MicroLogix 1400 zidentyfikowano problem z niewłaściwym ograniczeniem nadmiernych prób uwierzytelnienia. Wersje 16.00 i wcześniejsze nie penalizują wielokrotnego wprowadzania błędnych haseł.
An Improper Authorization issue was discovered in Sierra Wireless AirLink Raven XE (all versions prior to 4.0.14) and AirLink Raven XT (all versions prior to 4.0.11). Several files and directories can be accessed without authentication, which may allow a remote attacker to perform sensitive functions including arbitrary file upload, file download, and device reboot.
An Unrestricted Upload issue was discovered in Marel Food Processing Systems M3000 and M3210 terminals, allowing attackers to modify operations and upload firmware changes without detection.
W protokole Modicon Modbus firmy Schneider Electric odkryto problem z ominięciem uwierzytelniania poprzez przechwycenie i powtórzenie. Wrażliwe informacje są przesyłane w postaci niezaszyfrowanej, co umożliwia atakującemu powtórzenie poleceń takich jak uruchomienie, zatrzymanie, przesyłanie i pobieranie.
An Insufficiently Protected Credentials issue was discovered in Schneider Electric Modicon PLCs M241 and M251, all firmware versions. Log-in credentials are sent over the network with Base64 encoding, making them susceptible to sniffing.
A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241 and M251. The session numbers generated by the web application lack sufficient randomization and are shared among users, potentially allowing for session compromise.
A hard-coded password issue was discovered in Becton, Dickinson and Company (BD) PerformA, Version 2.0.14.0 and prior versions, and KLA Journal Service, Version 1.0.51 and prior versions. The use of hard-coded passwords to access the BD Kiestra Database could lead to a compromise of the confidentiality of limited PHI/PII information stored in the BD Kiestra Database.
A Hard-Coded Passwords issue was discovered in Marel Food Processing Systems M3000 and M3210 terminals. End users do not have the ability to change system passwords, which poses a significant security risk.
In ncurses 6.0, a format string vulnerability exists in the fmt_entry function. A crafted input can lead to remote arbitrary code execution.
In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input can lead to remote arbitrary code execution.
In Piwigo up to version 2.9.1, there is an SQL injection vulnerability in the administrative backend that allows remote users to execute arbitrary SQL commands via the cat_false or cat_true parameter in the comments or status page to cat_options.php.
EMC VASA Provider Virtual Appliance versions 8.3.x and prior has an unauthenticated remote code execution vulnerability that could potentially be exploited by malicious users to compromise the affected system.
A use-after-free vulnerability in the XML-LibXML module through version 2.0129 for Perl allows remote attackers to execute arbitrary code by controlling the arguments to a replaceChild call.
A use after free vulnerability in Adobe Flash Player exists in versions before 20.0.0.267 across various platforms, including Desktop Runtime, Google Chrome, Microsoft Edge, and Internet Explorer. It may lead to unauthorized memory access and potential execution of malicious code.
The custom authentication realm used by karaf-tomcat's 'opendaylight' realm in Opendaylight before Helium SR3 will authenticate any username and password combination.