CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
F5 SSL Intercept iApp versions 1.5.0 - 1.5.7 is vulnerable to an unauthenticated remote attack that may allow modification of the BIG-IP system configuration, extraction of sensitive system files, and possible remote command execution on the system when deployed using the Explicit Proxy feature plus SNAT Auto Map option for egress traffic.
AIRTAME HDMI dongle with firmware before version 2.2.0 allows unauthenticated access to a large part of the management interface. It is possible to extract all information including the Wi-Fi password, reboot the device, or force a software update at any time.
In the Linux kernel before version 4.5, there is a vulnerability that allows remote attackers to execute arbitrary code via UDP traffic. This issue occurs during an unsafe second checksum calculation during the execution of a recv system call with the MSG_PEEK flag.
Multiple SQL injection vulnerabilities in account/signup.php and account/signup2.php in WebsiteBaker 2.10.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username, (2) display_name parameter.
Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg.
During the installation of Ambari versions 2.4.0 to 2.4.2, Ambari Server artifacts are not created with proper access control lists (ACLs).
Cougar-LG stores sensitive information under the web root with insufficient access control, allowing remote attackers to obtain credentials.
mrlg-lib.php in mrlg4php before version 1.0.8 allows remote attackers to execute arbitrary shell code.
JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 22, allows remote attackers to cause a denial of service through heap-based out-of-bounds write, leading to application crash. The attack can be executed via crafted JavaScript code that triggers access to red-zone memory locations.
Devices Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC) version 1.13, and Air:Link 59300 (AL59300) version 1.04 (Rev. 4) allow remote attackers to execute arbitrary commands via shell metacharacters to certain /goform/* pages.
There is a vulnerability in Huawei Tecal devices that may lead to unauthorized access to the system. This affects multiple server models, including RH1288 V2, RH2265 V2, RH2285 V2, and others with specific software versions.
An issue was discovered in certain Apple products, including macOS before 10.12.4, related to the 'libxslt' component. This issue may lead to denial of service (memory corruption) or potentially other unspecified impacts via unknown vectors.
An issue was discovered in certain Apple products, including iOS before 10.3, related to the 'HomeKit' component. It allows attackers to have an unspecified impact by leveraging the presence of Home Control on Control Center.
An issue was discovered in certain Apple products related to the 'HTTPProtocol' component. Affects iOS before 10.3, macOS before 10.12.4, tvOS before 10.2, and watchOS before 3.2. The issue involves nghttp2 before 1.17.0.
An issue was discovered in certain Apple products affecting iOS before 10.3 and macOS before 10.12.4. The issue involves the 'Security' component and allows remote attackers to bypass intended access restrictions.
An issue was discovered in certain Apple products, including macOS before 10.12.4, involving mishandling of profile uninstall actions in the 'MCX Client' component when a profile has multiple payloads. This allows remote attackers to bypass intended access restrictions.
IBM Curam Social Program Management versions 6.0 and 7.0 are vulnerable to a denial of service caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume all available memory resources.
Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, and 11.0.18 and earlier have an exploitable memory corruption vulnerability in the rendering engine. Successful exploitation could lead to arbitrary code execution.
Snoopy allows remote attackers to execute arbitrary commands. This vulnerability exists due to an incomplete fix for CVE-2014-5008.
Snoopy allows remote attackers to execute arbitrary commands.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS