CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
BIG-IP versions 11.6.0-11.6.2, 12.0.0-12.1.2, and 13.0.0-13.0.0 are vulnerable to an Adaptive Chosen Ciphertext attack, also known as the Bleichenbacher attack. Exploiting this vulnerability may lead to plaintext recovery of encrypted messages and/or a Man-in-the-middle attack.
An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices that may lead to a denial of service.
jqueryFileTree version 2.1.5 and older is vulnerable to Directory Traversal attacks, allowing access to files and directories outside of intended paths.
Next.js before 2.4.1 has a directory traversal vulnerability in the /_next and /static request namespace, allowing attackers to obtain sensitive information.
Jool versions 3.5.0-3.5.1 are vulnerable to a kernel crashing packet resulting in a DoS attack.
An issue was discovered in Teluu pjproject (pjlib and pjlib-util) before version 2.7.1 related to the ioqueue component, which may lead to double key unregistration after an attacker initiates a connection with specific settings. This situation can trigger an integer overflow, resulting in future key registrations being rejected by ioqueue backends.
ROOT version 6.9.03 and below is vulnerable to an authenticated shell metacharacter injection in the rootd daemon resulting in remote code execution.
VMware Workstation (12.x before 12.5.8) and Horizon View Client for Windows (4.x before 4.6.1) contain an out-of-bounds read vulnerability in the JPEG2000 parser in TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation.
VMware Workstation (12.x before 12.5.8) and Horizon View Client for Windows (4.x before 4.6.1) contain an out-of-bounds read vulnerability in JPEG2000 parser in TPView.dll. This may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation or Horizon View Client.
VMware Workstation (12.x before 12.5.8) and Horizon View Client for Windows (4.x before 4.6.1) contain an out-of-bounds write vulnerability in JPEG2000 parser in TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation.
VMware Workstation (12.x before 12.5.8) and Fusion (8.x before 8.5.9) contain a heap buffer-overflow vulnerability in the VMNAT device. This issue may allow a guest to execute code on the host.
The Flash-based vSphere Web Client (6.0 prior to 6.0 U3c and 5.5 prior to 5.5 U3f) contains SSRF and CRLF injection issues due to improper neutralization of URLs. An attacker may exploit these issues by sending a modified POST request to internal services, leading to information disclosure.
VMware vCenter Server versions 6.5 prior to 6.5 U1 and 6.0 prior to 6.0 U3c do not correctly handle specially crafted LDAP network packets, which may allow for remote denial of service.
The CVE-2017-10887 vulnerability in BOOK WALKER for Windows version 1.2.9 and earlier has an untrusted search path that allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution due to a race condition in the plupload_action function in /wp-content/plugins/updraftplus/admin.php before deleting a file associated with the name parameter.
The UpdraftPlus plugin for WordPress through version 1.13.12 has an SSRF vulnerability in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin.php via an httpget subaction.
The p_mach.cpp file in UPX 3.94 has a vulnerability that allows remote attackers to cause a denial of service through invalid memory access and application crash by using a crafted Mach-O file. The issue is related to the canPack and unpack functions.
Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 allows an attacker to remotely execute code or cause denial of service.
Serendipity version 2.0.3 is vulnerable to a SQL injection in the blog component, resulting in information disclosure.
Codiad (full version) is vulnerable to write anything to the configuration file in the installation, resulting in the upload of a webshell.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS