CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The HIBUN Confidential File Decryption program prior to version 10.50.0.5 has an untrusted search path vulnerability that allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVE-2017-10864 describes an untrusted search path vulnerability in the installer of HIBUN Confidential File Viewer prior to version 11.20.0001, allowing an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
The HIBUN Confidential File Decryption program prior to version 10.50.0.5 has an untrusted search path vulnerability that allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Bamboo versions before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not sufficiently restrict which classes could be loaded. A user logged into Bamboo can exploit this vulnerability to execute arbitrary Java code on systems with vulnerable versions of Bamboo.
SQLite version 3.20.1 has a NULL pointer dereference in the tableColumnList function in shell.c. This issue occurs because certain cases where `sqlite3_step(pStmt)==SQLITE_ROW` is false are not considered, leading to an uninitialized data structure.
X-Cart versions 5.2.23, 5.3.1.9, 5.3.2.13, and 5.3.3 are vulnerable to Remote Code Execution. This vulnerability exists due to the application's failure to check remote file extensions before saving them locally.
The ReadPSDImage function in coders/psd.c in ImageMagick 7.0.7-6 has a vulnerability that allows remote attackers to cause application crashes or potentially other unspecified impacts via a crafted file.
RSA Archer GRC Platform prior to version 6.2.0.5 is affected by an arbitrary file upload vulnerability. A remote unauthenticated attacker may exploit this vulnerability to upload malicious files via attachments to arbitrary paths on the web server.
An integer overflow vulnerability exists in SDL 2.0.5 when creating a new RGB Surface. A specially crafted file can cause an integer overflow leading to insufficient memory allocation, resulting in a buffer overflow and potential code execution.
SDL_image 2.0.1 has a buffer overflow vulnerability in the XCF property handling functionality. A specially crafted xcf file can cause a stack-based buffer overflow, potentially leading to code execution.
IrfanView version 4.44 (32bit) contains a vulnerability that allows attackers to cause a denial of service or potentially have unspecified other impact via a crafted .tif file.
IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file.
IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file.
IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to a possible stack corruption.
IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file.
IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file.
IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file.
IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file.
IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file.
IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS