CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 use guessable session tokens, which are in the URL.
Sierra Wireless GX 440 devices with ALEOS firmware version 4.3.2 do not require authentication for Embedded_Ace_Get_Task.cgi requests.
Sierra Wireless GX 440 devices with ALEOS firmware version 4.3.2 have weak passwords for admin, rauser, sconsole, and user accounts.
Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow command injection via the Embedded_Ace_Set_Task.cgi script.
Osram Lightify Home before July 26, 2016, allows remote attackers to execute arbitrary commands via TCP port 4000.
A stack-based buffer overflow in the havok_write function in havok.c in Amazon Fire OS before January 15, 2016 allows attackers to cause a denial of service (panic) or possibly have unspecified other impact via a long string to /dev/hv.
Dell Integrated Remote Access Controller (iDRAC) 7/8 before version 2.21.21.21 has an XXE vulnerability.
Dell Integrated Remote Access Controller (iDRAC) 6 before version 2.80 and 7/8 before version 2.21.21.21 is vulnerable to attacks that can lead to denial of service (buffer overflow) or other unspecified impacts via a long SSH username or input.
Dell Integrated Remote Access Controller (iDRAC) 7/8 before version 2.21.21.21 has a format string issue in the racadm getsystinfo command.
The SPDY/2 codec in Facebook Proxygen before 2015-11-09 truncates a certain field to two bytes, which allows hijacking and injection attacks.
The Summer Baby Zoom Wifi video monitoring system allows remote attackers to bypass authentication, related to the MySnapCam web service.
iBaby M3S has a password of 'admin' for the backdoor admin account.
Lens Peek-a-View contains default passwords for admin, user, and guest accounts, posing a serious security risk.
The Philips In.Sight B120/37 device has several accounts with default passwords that are easy to guess. Among them are passwords for root, admin, and user accounts, posing a serious security risk.
Gynoii has a password of 'guest' for the guest backdoor account and a password of '12345' for the admin backdoor account, which poses a serious security risk.
The Binary File Descriptor (BFD) library in GNU Binutils 2.28 has an undefined behavior issue related to member access within a null pointer, which may lead to application crashes.
CVE-2017-0561 describes a remote code execution vulnerability in the Broadcom Wi-Fi firmware that allows a remote attacker to execute arbitrary code within the context of the Wi-Fi SoC. This issue is rated as Critical due to the potential for remote code execution.
Dataprobe iBootBar (with firmware from 2007-09-20 and possibly later beta versions) allows remote attackers to bypass authentication and conduct power-cycle attacks on connected devices via a DCCOOKIE cookie.
Dataprobe iBootBar (with firmware from 2007-09-20 and possibly later) allows remote attackers to bypass authentication and conduct power-cycle attacks on connected devices via a DCRABBIT cookie.
SQL injection vulnerability in NewsController.php in the News module 5.3.2 and earlier for TYPO3 allows unauthenticated users to execute arbitrary SQL commands via vectors involving overwriteDemand for order and OrderByAllowed.