CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before version 4.2.8p4 and 4.3.x before version 4.3.77 allows remote attackers to cause a denial of service through excessive memory consumption.
The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash).
The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted packets containing particular autokey operations.
Yeager CMS version 1.2.1 has an unrestricted file upload vulnerability that allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
An incomplete blacklist vulnerability in SuiteCRM version 7.2.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension.
The coders/wpg.c file in ImageMagick contains a vulnerability that allows remote attackers to have unspecified impact via a corrupted wpg file.
The vulnerability in coders/sun.c in ImageMagick allows remote attackers to have unspecified impact via a corrupted sun file.
The coders/psd.c file in ImageMagick contains a vulnerability that allows remote attackers to have unspecified impact via a crafted psd file.
The vulnerability in coders/xpm.c in ImageMagick allows remote attackers to have unspecified impact via a crafted xpm file.
The '.encfs6.xml' configuration file in encfs before version 1.7.5 allows remote attackers to access sensitive data by setting 'blockMACBytes' to 0 and adding 8 to 'blockMACRandBytes'.
A stack-based buffer overflow in the 'yyerror' function in Graphviz 2.34.0 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted file. This vulnerability exists due to an incomplete fix for CVE-2014-0978.
360 Total Security version 9.0.0.1202 and earlier before 2017-07-07 allows Privilege Escalation via a Trojan horse Shcore.dll file in any directory in the PATH, as demonstrated by the C:\Python27 directory.
The Loginizer plugin for WordPress before version 1.3.6 has a Cross Site Request Forgery (CSRF) vulnerability in the IP Blacklist and Whitelist Wizard because the HTTP Referer header is not checked.
NetApp SnapCenter Server 1.0 allows remote authenticated users to list and delete backups.
In ctools 6.x-1.x before 6.x-1.14 and 7.x-1.x before 7.x-1.8 in Drupal, the 'edit' permission for 'content type' plugins used in systems like Panels is not verified.
In grml-debootstrap in Debian versions 0.54, 0.68.x before 0.68.1, and 0.7x before 0.78, the cmdlineopts.clp file is sourced without checking if the local directory is writable by non-root users.
The Duplicator plugin in WordPress before version 0.5.10 allows remote authenticated users to create and download backup files.
The basic_settings function in the download manager plugin for WordPress before version 2.7.3 allows remote authenticated users to update every WordPress option.
Directory traversal vulnerability in the BusyBox implementation of tar before version 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.
In Apache Commons Email versions 1.0 through 1.4, passing a subject for an email that contains line-breaks allows the caller to add arbitrary SMTP headers.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS