CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The web management interface on Belkin F9K1102 devices with firmware 2.10.17 has a blank password, allowing remote attackers to gain administrative privileges by leveraging a LAN session.
The web administration interface on ReadyNet WRT300N-DD devices with firmware 1.0.26 has a default password of 'admin' for the admin account, allowing remote attackers to obtain administrative privileges by leveraging a LAN session.
The web administration interface on Amped Wireless R10000 devices with firmware 2.5.2.11 has a default password of 'admin' for the admin account, allowing remote attackers to gain administrative privileges by leveraging a LAN session.
The diagnostic-ping implementation on ZyXEL PMG5318-B20A devices with firmware before 1.00(AANC.2)C0 allows remote attackers to execute arbitrary commands via the PingIPAddr parameter.
ZyXEL P-660HW-T1, PMG5318-B20A, and NBG-418N devices have a default password of '1234' for the admin account, allowing remote attackers to gain administrative access.
Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 and Tenda N3 Wireless N150 devices allow remote attackers to obtain administrative access via a certain admin substring in an HTTP Cookie header.
Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before version 3.4.1.105 have a default password of 'root' for the root account, allowing remote attackers to gain administrative access via a TELNET session.
Corega CG-WLBARGS devices allow remote attackers to perform administrative operations via unspecified vectors.
ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE have a hardcoded password of 'root' for the root account, allowing remote attackers to gain administrative access via a TELNET session.
Adobe Flash Player versions before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, as well as Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
The login page in Epiphany Cardio Server versions 3.3, 4.0, and 4.1 mishandles authentication requests, allowing remote attackers to conduct LDAP injection attacks and bypass intended access restrictions via a crafted URL.
SQL injection vulnerability in the login page in Epiphany Cardio Server 3.3 allows remote attackers to execute arbitrary SQL commands via a crafted URL.
The MIDI subsystem in Google Chrome before version 47.0.2526.106 does not properly handle the sending of data, allowing remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.
The Adcon Telemetry A840 telemetry gateway has hardcoded credentials, allowing remote attackers to gain administrative access via unspecified vectors.
The ChangePasswordIndex method in PasswordReset.dll in Dovestones AD Self Password Reset before version 3.0.4.0 allows remote attackers to reset arbitrary passwords via a crafted request with a valid username.
eWON devices with firmware before version 10.1s0 omit RBAC for I/O server information and status requests, allowing remote attackers to obtain sensitive information via an unspecified URL.
Saia Burgess devices PCD1.M0xx0, PCD1.M2xx0, PCD2.M5xx0, PCD3.Mxx60, PCD3.Mxxx0, PCD7.D4xxD, PCD7.D4xxV, PCD7.D4xxWTPF, PCD7.D4xxxT5F, and PCD3.T665 and PCD3.T666 before versions 1.24.50 and 1.24.41 have hardcoded credentials, allowing remote attackers to gain administrative access via an FTP session.
SearchBlox 8.3 before 8.3.1 allows remote attackers to write to the config file, potentially leading to application crashes.
Wersje Juniper ScreenOS od 6.2.0r15 do 6.2.0r18 oraz od 6.3.0r12 do 6.3.0r20 przed odpowiednimi poprawkami umożliwiają zdalnym atakującym uzyskanie dostępu administracyjnego poprzez wprowadzenie nieokreślonego hasła podczas sesji SSH lub TELNET.
Interfejsy obiektów zserializowanych w niektórych produktach Cisco Collaboration i Social Media, a także w urządzeniach zabezpieczeń sieciowych, umożliwiają zdalnym atakującym wykonanie dowolnych poleceń za pomocą spreparowanego zserializowanego obiektu Java, związane z biblioteką Apache Commons Collections.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS