CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CodeIgniter version 3.1.3, used by the British Columbia Institute of Technology, is vulnerable to HTTP Header Injection in the set_status_header() function under Apache, leading to HTTP Header Injection flaws.
The application OpenEMR versions 5.0.0, 5.0.1-dev and prior is affected by a vertical privilege escalation vulnerability. This vulnerability allows authenticated non-administrator users to view and modify information only accessible to administrators.
InvoicePlane version 1.4.10 is vulnerable to an Arbitrary File Upload, allowing an authenticated user to upload a malicious file to the webserver. An attacker can upload a script that can compromise the webserver.
Nodejs ejs versions older than 2.5.5 are vulnerable to a denial-of-service attack due to weak input validation in the ejs.renderFile() function.
A vulnerability in Swagger-Parser's yaml parsing functionality (version <= 1.0.30) allows arbitrary code execution when a maliciously crafted yaml Open-API specification is parsed. This particularly affects the 'generate' and 'validate' commands in swagger-codegen (<= 2.2.2).
tcmu-runner versions 1.0.5 to 1.2.0 are vulnerable to a dbus triggered NULL pointer dereference in the tcmu-runner daemon's on_unregister_handler() function resulting in denial of service.
tcmu-runner versions 0.91 to 1.20 are vulnerable to information disclosure in handler_qcow.so, allowing non-privileged users to check for the existence of any file with root privileges.
The tcmu-runner daemon versions 0.9.0 to 1.2.0 is vulnerable to invalid memory references in the handler_glfs.so handler, resulting in denial of service.
October CMS version 412 is vulnerable to PHP object injection in asset move functionality, allowing for the deletion of files limited by file permissions on the server.
An address access exception was found in SWFTools pdf2swf in the FoFiTrueType::writeTTF() function.
CVE-2017-0865 is a privilege escalation vulnerability in the MediaTek soc driver affecting Android, including the Android kernel.
CVE-2017-0864 is a privilege escalation vulnerability in the MediaTek ioctl (flashlight) in Android. It affects the Android kernel.
CVE-2017-0863 describes an elevation of privilege vulnerability in the Upstream kernel video driver affecting Android and its kernel.
CVE-2017-0862 is a privilege escalation vulnerability in the Android kernel. It affects unspecified versions of the Android kernel.
Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows attackers to gain privileges via unspecified vectors.
Another vulnerability in the Android media framework affecting versions 7.0, 7.1.1, and 7.1.2.
A vulnerability has been identified in the Android media framework that affects versions 7.0, 7.1.1, 7.1.2, and 8.0. This issue may lead to unauthorized access to system data or functions.
CVE-2017-0857 is a vulnerability in the Android media framework affecting versions 7.0, 7.1.1, 7.1.2, and 8.0. It may allow unauthorized access or execution of malicious code.
CVE-2017-0852 is a vulnerability in the Android media framework (libhevc) that can lead to denial of service.
CVE-2017-0845 is a denial of service vulnerability in the Android framework (syncstorageengine). It affects Android versions from 5.0.2 to 7.1.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS