CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unspecified vulnerability in IBM Security QRadar SIEM 7.1 MR2 and 7.2 MR2 allows remote attackers to execute arbitrary code via unknown vectors.
The Infusionsoft Gravity Forms plugin versions 1.5.3 to 1.5.10 for WordPress does not properly restrict access, allowing remote attackers to upload arbitrary files and execute arbitrary PHP code via a request to utilities/code_generator.php.
A vulnerability in Mozilla Network Security Services (NSS) before version 3.16.2.1 and in various browser versions involves improper parsing of ASN.1 values in X.509 certificates. This allows remote attackers to spoof RSA signatures using a crafted certificate.
The ALG module in Cisco IOS versions 15.0 through 15.4 does not properly implement SIP over NAT, allowing remote attackers to cause a denial of service (device reload) via multipart SDP IPv4 traffic.
Cisco IOS versions 12.4 and 15.0 through 15.4 and IOS XE 3.1.xS to 3.11.xS before 3.12S are vulnerable to an attack that can lead to denial of service via a crafted SIP message.
A memory leak exists in Cisco IOS versions 15.1 through 15.4 and IOS XE in certain versions that can be exploited by remote attackers. Attackers can cause a denial of service by sending malformed DHCPv6 packets.
A memory leak in Cisco IOS 15.0, 15.1, 15.2, and 15.4 and IOS XE 3.3.xSE before 3.3.2SE, 3.3.xXO before 3.3.1XO, 3.5.xE before 3.5.2E, and 3.11.xS before 3.11.1S allows remote attackers to cause a denial of service via malformed mDNS packets.
Cisco IOS versions 15.0, 15.1, 15.2, and 15.4, as well as IOS XE versions 3.3.xSE before 3.3.2SE, 3.3.xXO before 3.3.1XO, 3.5.xE before 3.5.2E, and 3.11.xS before 3.11.1S are vulnerable to an attack that can cause a denial of service via malformed mDNS packets.
The metadata flow feature in Cisco IOS versions 15.1 through 15.3 and IOS XE before version 3.3.1XO, 3.6.xS and 3.7.xS before 3.7.6S, as well as 3.8.xS, 3.9.xS, and 3.10.xS before 3.10.1S, allows remote attackers to cause a denial of service (device reload) via malformed RSVP packets.
The metadata flow feature in Cisco IOS versions 15.1 through 15.3 and IOS XE before 3.3.1XO, 3.6.xS and 3.7.xS before 3.7.6S, as well as 3.8.xS, 3.9.xS, and 3.10.xS before 3.10.1S allows remote attackers to cause a denial of service (device reload) via malformed RSVP packets.
Cisco IOS versions 12.0, 12.2, 12.4, 15.0, 15.1, 15.2, 15.3 and IOS XE 2.x and 3.x before 3.7.4S are vulnerable to an attack that can lead to a denial of service (device reload) via malformed RSVP packets.
IBM System Networking switches G8052, G8124, G8124-E, G8124-ER, G8264, G8316, G8264-T and other listed models have hardcoded credentials, making it easier for remote attackers to gain access to the system.
The acpi-support package in Debian before version 0.140-5+deb7u3 allows local users to gain privileges through manipulation of the 'user's environment'.
Cobham Aviator 700D and 700E satellite terminals use an improper algorithm for PIN codes, making it easier for attackers to obtain a privileged terminal session by calculating the superuser code.
A SQL injection vulnerability was found in the Wiki Server in CoreCollaboration in Apple OS X Server before version 2.2.3 and 3.x before version 3.2.1. It allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
An unspecified IOAcceleratorFamily function in Apple OS X before 10.9.5 lacks proper bounds checking on read operations, which allows attackers to execute arbitrary code in a privileged context via a crafted application.
Buffer overflow in the shader compiler in the Intel Graphics Driver subsystem in Apple OS X before 10.9.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted GLSL shader.
Bluetooth in Apple OS X before 10.9.5 does not properly validate API calls, which allows attackers to execute arbitrary code in a privileged context via a crafted application.
IOKit in IOAcceleratorFamily in Apple OS X before 10.9.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via an application that provides crafted API arguments.
Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, and Office for Mac versions improperly parse record lengths, allowing remote attackers to execute arbitrary code via a malformed control in an Office document.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS