CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Microsoft Skype version 7.16.0.102 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system. The issue arises from the way .dll files are loaded by Skype.
The User::randomPassword function in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 generates passwords smaller than $wgMinimalPasswordLength, making it easier for remote attackers to gain access via a brute-force attack.
The Soft Access Point feature in Samsung Smart TVs X10P, X12, X14H, X14J, and NT14U and Xpress M288OFW printers generate weak WPA2 PSK keys, making it easier for remote attackers to obtain sensitive information or bypass authentication via a brute-force attack.
Cloudera Key Trustee Server before 5.4.3 does not store keys synchronously, which might allow attackers to have unspecified impact via vectors related to loss of an encryption key.
The _mediaLibraryPlayCb function in mainwindow.py in pitivi before 0.95 allows attackers to execute arbitrary code via shell metacharacters in a file path.
PHPMemcachedAdmin version 1.2.2 and earlier allows remote attackers to execute arbitrary PHP code via vectors related to serialized data and the last part of the concatenated filename, which creates a file in the webroot.
The Konke Smart Plug K does not require authentication for TELNET sessions, allowing remote attackers to obtain 'equipment management authority' via TCP traffic to port 23.
QNAP QTS before version 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors.
QNAP QTS before version 4.2.4 Build 20170313 allows attackers to gain administrator privileges and access sensitive information via unspecified vectors.
QNAP QTS versions before 4.2.4 Build 20170313 allow attackers to gain administrator privileges and execute arbitrary commands via unspecified vectors.
The ip6gre_err function in the Linux kernel allows remote attackers to have unspecified impact via vectors involving GRE flags in an IPv6 packet, leading to out-of-bounds access.
The kbase_dispatch function in the GPU driver on Samsung devices with M(6.0) and N(7.0) software and Exynos AP chipsets allows attackers to have unspecified impact via unknown vectors, leading to an out-of-bounds read.
Firejail before 0.9.44.4, when running on a Linux kernel before 4.8, allows context-dependent attackers to bypass a seccomp-based sandbox protection mechanism via the --allow-debuggers argument.
The iManager Admin Console in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to iFrame manipulation attacks, potentially allowing remote users to access authentication credentials.
AlienVault USM and OSSIM before version 5.3.7 and NfSen before version 1.3.8 have an error in privilege dropping, resulting in unnecessary execution of NfSen Perl code as root.
A vulnerability in the Data-in-Motion (DMo) process installed with the Cisco IOx application environment could allow an unauthenticated, remote attacker to cause a stack overflow that could allow remote code execution with root privileges in the virtual instance running on an affected device.
Disk Sorter Enterprise versions 9.5.12 and earlier have a buffer overflow vulnerability that allows remote attackers to execute arbitrary code via a GET request.
The pe_ILF_object_p function in the Binary File Descriptor (BFD) library in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read of size 4049 because it uses the strlen function instead of strnlen. This can lead to crashes in programs such as addr2line, size, and strings, as well as information disclosure.
An issue was discovered in exception_wrapper.py in OpenStack Nova versions 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens.
ihex.c in GNU Binutils before version 2.26 contains a stack buffer overflow when printing bad bytes in Intel Hex objects.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS