CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The MIT Kerberos 5 (krb5) library up to version 1.15.2 mishandles Distinguished Name (DN) fields, allowing remote attackers to execute arbitrary code or cause application crashes via buffer overflow.
The UMA product with software versions V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges.
The UMA product with software versions V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges.
The UMA product with software version V200R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges.
The UMA product with software version V200R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges.
The UMA product with software V200R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges.
The UMA product with software version V200R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges.
The UMA product with software versions V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges.
The UMA product with software versions V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges.
The UMA product with software versions V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges.
VCM5010 with software versions earlier than V100R002C50SPC100 has an authentication bypass vulnerability and an arbitrary file upload vulnerability. An unauthenticated attacker can bypass the login process, while an authenticated attacker can upload unvalidated files to the system.
CVE-2017-13071 allows a remote attacker to execute arbitrary commands on QNAP Video Station versions 5.1.3 (for QTS 4.3.3), 5.2.0 (for QTS 4.3.4), and earlier.
Client-side enforcement using JavaScript on the Cohu 3960HD camera allows an attacker to manipulate options sent to the camera, potentially leading to malfunction or code execution.
The webupgrade function on the Cohu 3960HD does not verify the firmware upgrade files, allowing an attacker to upload a specially crafted postinstall.sh file that will be executed with 'root' privileges.
Missing authentication for the remote configuration port 1236/tcp on the Cohu 3960HD allows an attacker to change configuration parameters such as IP address and username/password via specially crafted XML SOAP packets.
Ohcount version 3.0.0 is prone to command injection via specially crafted filenames containing shell metacharacters. An attacker can exploit this vulnerability by providing a source tree for Ohcount processing, allowing arbitrary code execution as the user running Ohcount.
A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs.
Fiyo CMS 2.0_1.9.1 has multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. The attack can be carried out via the 'id' parameter in rating.php or the 'user' parameter in the login process.
A vulnerability in the Intel Deep Learning Training Tool Beta 1 allows a network attacker to remotely execute code as a local user.
In dayrui FineCms version 5.2.0, the v5/config/system.php file has a default SYS_KEY value and does not require key regeneration for each installation. This allows remote attackers to upload arbitrary .php files via a member api swfupload action to index.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS