CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server versions 2.4.24 and 2.4.25 to dereference a NULL pointer and crash the server process.
OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, allowing remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session.
The gs_alloc_ref_array function in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted PostScript document. This is related to a lack of an integer overflow check in base/gsalloc.c.
The xps_decode_font_char_imp function in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service through heap-based buffer over-read, leading to application crash. The attack can be executed via a crafted document.
The Ins_JMPR function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.
The gx_ttfReader__Read function in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service through heap-based buffer over-read, leading to application crash.
The Ins_MDRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.
The xps_select_font_encoding function in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service through heap-based buffer over-read and application crash via a crafted document.
The xps_true_callback_glyph_name function in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause an application crash via a crafted file.
The xps_load_sfnt_name function in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause an application crash via a crafted document due to a buffer overflow.
The Ins_IP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact via a crafted document.
The Ins_MIRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.
The xps_load_sfnt_name function in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service through heap-based buffer over-read, leading to application crash. Other unspecified impacts may also be possible.
The WP Rocket plugin version 2.9.3 for WordPress has a security vulnerability that allows bypassing the local file inclusion mitigation technique by using 0x00 bytes. An attacker can exploit this vulnerability to perform a Local File Inclusion attack.
A sandbox escape in the Lua interface in Wube Factorio before version 0.15.31 allows remote game servers or user-assisted attackers to execute arbitrary C code by including and loading a C library.
A memory leak was found in SIPcrack 0.2 related to the processing of SIP traffic due to mismanagement of a lines array. A remote attacker could potentially exploit this flaw to crash long-running sipdump sniffing sessions.
Waves MaxxAudio, installed on Dell laptops, adds a Windows service 'WavesSysSvc' with File Version 1.1.6.0, which has a vulnerability known as Unquoted Service Path. This could allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system.
GraphicsMagick 1.3.26 has a NULL pointer dereference in the WriteMAPImage() function in coders/map.c when processing a non-colormapped image. This is a different vulnerability than CVE-2017-11638.
GraphicsMagick version 1.3.26 has a segmentation violation in the WriteMAPImage() function in coders/map.c when processing a non-colormapped image. This is a different vulnerability than CVE-2017-11642.
Fiyo CMS version 2.0.7 contains a vulnerability that allows remote attackers to delete arbitrary files via directory traversal sequences in the file parameter in a type=database request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS