CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in the detection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, adjacent attacker to send data directly to the kernel of an affected device. The issue is due to improper filtering of Ethernet frames. An attacker could exploit this by sending crafted packets to the management interface, bypassing Layer 2 filters.
A vulnerability in the WebVPN service of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition. The issue is due to improper management of authenticated sessions in the WebVPN portal. An attacker could authenticate with valid credentials and access a specific URL, causing the device to reload and resulting in temporary DoS.
In osTicket before version 1.12, an XSS vulnerability exists via uploading a crafted CSV file to the User Importer. File contents can appear in an error message, allowing script execution in the browser. This can lead to local file inclusion.
W kontrolerach Rockwell Automation MicroLogix 1400 Series A, wszystkich wersjach Series B, w wersji v15.002 i wcześniejszych, oraz w kontrolerach MicroLogix 1100 v14.00 i wcześniejszych, występuje podatność na otwarte przekierowanie. Umożliwia to zdalnemu, nieautoryzowanemu atakującemu wprowadzenie złośliwego linku, który może przekierować użytkowników na złośliwą stronę.
An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0704 and CVE-2019-0821.
In MISP before version 2.4.105, there is a Reflected XSS vulnerability in the default layout template app/View/Layouts/default.ctp.
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.
In urllib2 (Python 2.x through 2.7.16) and urllib (Python 3.x through 3.7.3), CRLF injection is possible if an attacker controls a URL parameter. The injection occurs via \r\n characters in the path component of a URL that lacks a ? character, followed by an HTTP header or a Redis command. This is similar to CVE-2019-9740 and is fixed in later Python versions.
An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
W komponentach Gecko systemu KaiOS 2.5 10.05 na urządzeniach Nokia 8810 4G odkryto problem z odmową usługi. Odwiedzenie specjalnie przygotowanej strony internetowej w wewnętrznej przeglądarce powoduje awarię procesu Gecko z błędem segmentacji.
Intel(R) Graphics Driver for Windows contains a use-after-free in the Kernel Mode Driver. An unprivileged user can potentially cause a denial of service via local access.
Intel(R) Graphics Driver for Windows contains an out-of-bounds read in igdkm64.sys. An authenticated user can potentially enable denial of service via local access.
Intel(R) Graphics Driver for Windows contains multiple out-of-bounds reads in igdkm64.sys. An authenticated user can potentially enable information disclosure via local access.
Intel(R) Graphics Driver for Windows contains insufficient access control in the User Mode Driver. An unprivileged user can potentially escape from a virtual machine guest-to-host via local access.
Insufficient input validation in Kernel Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and 24.20.100.6373 potentially enables an unprivileged user to read memory via local access via local access.
Intel(R) Graphics Driver for Windows contains insufficient input validation in the Kernel Mode Driver. A privileged user can exploit this locally to cause a denial of service.
Intel(R) Graphics Driver for Windows contains potential memory corruption in the Kernel Mode Driver. An unprivileged user can potentially cause a denial of service via local access.
Buffer overflow in User Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and 24.20.100.6373 potentially enables an unprivileged user to cause a denial of service via local access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS