CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Bitlbee-libpurple before version 3.5.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a file transfer request for a contact that is not in the contact list.
A use-after-free vulnerability in bitlbee-libpurple before version 3.5 allows remote servers to cause a denial of service (crash) or possibly execute arbitrary code by causing a file transfer connection to expire.
Buffer overflow in Broadcom ACSD allows remote attackers to execute arbitrary code via a long string to TCP port 5916. This component is used on routers of multiple vendors including ASUS RT-AC66U and TRENDnet TEW-812DRU.
An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, caused by lack of a protection mechanism involving HTTP Access-Control headers. An attacker can send cross-domain requests directly to the REST API for users with a valid session cookie and receive the result.
QOS.ch Logback versions before 1.2.0 have a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.
A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models allows an attacker to craft a malformed HTTP request that discloses the configuration file with the login password.
An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1 that allows attackers to login using the hashed password instead of the valid password string.
OxygenOS before version 4.0.2 on OnePlus 3 and 3T has two hidden fastboot oem commands that allow an attacker to lock/unlock the bootloader without user confirmation. This allows for persistent code execution with high privileges and complete access to user data.
An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T that allows an attacker to persistently make the (locked) bootloader start with dm-verity disabled. This results in the kernel not verifying the system partition, potentially allowing for persistent code execution and privilege escalation.
The WHMCS Reseller Module V2 2.0.2 in Softaculous Virtualizor before 2.9.1.0 does not verify users correctly, allowing remote authenticated users to control other virtual machines managed by Virtualizor by accessing a modified URL.
Parser Multipart Jakarta w Apache Struts 2 w wersjach 2.3.x przed 2.3.32 oraz 2.5.x przed 2.5.10.1 ma błędne zarządzanie wyjątkami i generowanie komunikatów o błędach podczas prób przesyłania plików. To umożliwia zdalnym atakującym wykonywanie dowolnych poleceń poprzez spreparowane nagłówki HTTP Content-Type, Content-Disposition lub Content-Length.
In version 2.2.16 of Azure Data Expert Ultimate, there is a buffer overflow vulnerability in the SMTP verification function, which can lead to remote code execution. An attacker can exploit this by using a crafted SMTP daemon that sends a long 220 string.
On Cambium Networks cnPilot R200/201 devices before version 4.3, there is a vulnerability involving the device's certificate and its RSA keys.
A buffer overflow exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packet can be sent to the victim's computer, leading to a heap-based buffer overflow and potential remote code execution.
A buffer overflow exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packet can be sent to the victim's computer and can lead to a heap based buffer overflow resulting in potential remote code execution.
An exploitable buffer overflow exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packet can be sent to the victim's computer and can lead to a heap based buffer overflow resulting in remote code execution.
A Remote Code Execution vulnerability was discovered in FTPShell Client 6.53. The client by default sends a PWD command to the FTP server it connects to, but it does not check the response's length, leading to a buffer overflow situation.
An issue was discovered in dnaTools dnaLIMS 4-2015s13 related to unauthenticated command execution through an improperly protected administrative web shell (cgi-bin/dna/sysAdmin.cgi in POST requests).
iball Baton 150M iB-WRA150N v1 00000001 1.2.6 build 110401 Rel.47776n devices are prone to an authentication bypass vulnerability that allows remote attackers to view and modify administrative router settings by reading the HTML source code of the password.cgi file.
Buffer overflows in the networkmap function on ASUS RT-N56U, RT-N66U, RT-AC66U, and other routers allow remote attackers to execute arbitrary code. The issue affects routers with firmware versions prior to 3.0.0.4.380.7378 and other listed models.