CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Memory corruption vulnerability in OriginLab Origin Viewer OGW file parsing allows remote code execution. Lack of proper validation of user-supplied data leads to memory corruption. User interaction is required, such as visiting a malicious page or opening a malicious file.
Out-of-bounds write in OriginLab Origin Viewer OPJ file parsing allows remote code execution. Lack of proper validation of user-supplied data leads to write past the end of an allocated data structure. User interaction is required, such as visiting a malicious page or opening a malicious file.
Memory corruption vulnerability in OriginLab OriginPro OGG file parsing allows remote code execution. Lack of proper validation of user-supplied data leads to memory corruption. User interaction is required, such as visiting a malicious page or opening a malicious file.
Memory corruption vulnerability in OriginLab OriginPro OGW file parsing allows remote code execution. Lack of proper validation of user-supplied data leads to memory corruption. User interaction is required, such as visiting a malicious page or opening a malicious file.
Out-of-bounds write in OriginLab OriginPro OGG file parsing allows remote code execution. Lack of proper validation of user-supplied data leads to write past the end of an allocated data structure. User interaction is required, such as visiting a malicious page or opening a malicious file.
Vulnerability in OriginLab OriginPro during parsing of OPJ files allows remote code execution. Lack of user data validation leads to a write past the end of an allocated data structure. User interaction is required, such as opening a malicious file.
Vulnerability in OriginLab OriginPro during parsing of OPJU files allows remote code execution. Lack of user data validation leads to a write past the end of an allocated data structure. User interaction is required, such as opening a malicious file.
Vulnerability in the aeon library in the load_time_series_segmentation_benchmark method allows remote code execution via Python code injection. Lack of string validation before using it to execute code. User interaction is required.
Vulnerability in the aeon library in the load_human_activity_segmentation_datasets method allows remote code execution via Python code injection. Lack of string validation before using it to execute code. User interaction is required.
Vulnerability in the Aeon library in the load_rehab_pile_dataset method allows remote code execution via deserialization of untrusted data. Lack of user data validation leads to deserialization of untrusted objects. User interaction is required.
Vulnerability in Sony XAV-9500ES device in crash dump handling allows local privilege escalation via command injection. Lack of string validation before using it in a system call. Requires low-privileged access to the system.
A vulnerability in Sony XAV-9500ES devices allows physically present attackers to bypass authorization by connecting a crafted USB device. The flaw exists in the udev rules, which can trigger instantiation of restricted USB device types. Authentication is not required to exploit this vulnerability.
Vulnerability in Sony XAV-9500ES device in AVRCP_Br_Response_Parser allows remote code execution via heap-based buffer overflow. Lack of length validation before copying data to a buffer. Requires pairing a malicious Bluetooth device.
Vulnerability in Sony XAV-9500ES device in l2_reassemble_sdu allows remote code execution via heap-based buffer overflow. Lack of length validation before copying data to a buffer. Requires pairing a malicious Bluetooth device.
A vulnerability in Sony XAV-9500ES devices allows physically present attackers to execute arbitrary code in the context of the gpsd daemon. The flaw is due to improper validation of NMEA data length before copying to a fixed-length buffer, leading to a buffer overflow. Authentication is not required.
Vulnerability in Sony XAV-9500ES device in handling of RTSP SETUP packets allows remote code execution via buffer overflow. Lack of length validation before copying data to a fixed-length buffer. Authentication is not required.
A vulnerability in Sony XAV-9500ES devices allows network-adjacent attackers to disclose sensitive information via an out-of-bounds read when handling Bluetooth L2CAP packets. The attacker must first pair a malicious Bluetooth device with the target system.
Vulnerability in Heimdall Data Database Proxy in the uploadJar method allows remote code execution via directory traversal. Lack of path validation before using it in file operations. Authentication is required.
The vulnerability in Kenwood DNR1007XR concerns incorrect default permissions on a directory used by the USB filesystem. An attacker with physical access and the ability to execute low-privileged code can escalate privileges and execute arbitrary code as root.
The vulnerability in Kenwood DNR1007XR in the startUpdateProcess method allows command injection. An attacker with physical access, without authentication, can exploit the lack of input validation to execute arbitrary code as root.