CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Botan versions 1.11.x before 1.11.22 improperly handle wildcard matching against hostnames, which might allow remote attackers to have unspecified impact via a valid X.509 certificate.
Web2py versions before 2.14.6 do not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.
CloudView NMS before version 2.10a has a format string issue that can be exploited over SNMP.
Sierra Wireless GX 440 devices with ALEOS firmware version 4.3.2 store passwords in cleartext.
Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 use guessable session tokens, which are in the URL.
Sierra Wireless GX 440 devices with ALEOS firmware version 4.3.2 do not require authentication for Embedded_Ace_Get_Task.cgi requests.
Sierra Wireless GX 440 devices with ALEOS firmware version 4.3.2 have weak passwords for admin, rauser, sconsole, and user accounts.
Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow command injection via the Embedded_Ace_Set_Task.cgi script.
Osram Lightify Home before July 26, 2016, allows remote attackers to execute arbitrary commands via TCP port 4000.
A stack-based buffer overflow in the havok_write function in havok.c in Amazon Fire OS before January 15, 2016 allows attackers to cause a denial of service (panic) or possibly have unspecified other impact via a long string to /dev/hv.
Dell Integrated Remote Access Controller (iDRAC) 7/8 before version 2.21.21.21 has an XXE vulnerability.
Dell Integrated Remote Access Controller (iDRAC) 6 before version 2.80 and 7/8 before version 2.21.21.21 is vulnerable to attacks that can lead to denial of service (buffer overflow) or other unspecified impacts via a long SSH username or input.
Dell Integrated Remote Access Controller (iDRAC) 7/8 before version 2.21.21.21 has a format string issue in the racadm getsystinfo command.
The SPDY/2 codec in Facebook Proxygen before 2015-11-09 truncates a certain field to two bytes, which allows hijacking and injection attacks.
The Summer Baby Zoom Wifi video monitoring system allows remote attackers to bypass authentication, related to the MySnapCam web service.
iBaby M3S has a password of 'admin' for the backdoor admin account.
Lens Peek-a-View contains default passwords for admin, user, and guest accounts, posing a serious security risk.
The Philips In.Sight B120/37 device has several accounts with default passwords that are easy to guess. Among them are passwords for root, admin, and user accounts, posing a serious security risk.
Gynoii has a password of 'guest' for the guest backdoor account and a password of '12345' for the admin backdoor account, which poses a serious security risk.
The Binary File Descriptor (BFD) library in GNU Binutils 2.28 has an undefined behavior issue related to member access within a null pointer, which may lead to application crashes.