CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.25)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The libautotrace.a in AutoTrace 0.31.1 has a vulnerability that allows remote attackers to cause a denial of service (invalid write and SEGV), related to the pnm_load_ascii function in input-pnm.c:303:12.
libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid read and SEGV), related to the input_pnm_reader function in input-pnm.c:243:3.
The libautotrace.a in AutoTrace 0.31.1 has a vulnerability that allows remote attackers to cause a denial of service (invalid read and SEGV), related to the GET_COLOR function in color.c.
Sinopia, used in SAP HANA XS versions 1.00 and 2.00, allows remote attackers to cause a denial of service by pushing a package with a filename containing a $ (dollar sign) or % (percent) character.
Sinopia, used in SAP HANA XS versions 1.00 and 2.00, allows remote attackers to hijack npm packages or host arbitrary files by leveraging an insecure user creation policy.
The Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via a crafted XML document in a request to a specific endpoint.
A memory leak in audio/audio.c in QEMU allows remote attackers to cause a denial of service by repeatedly starting and stopping audio capture.
The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.
In zlib version 1.2.8, the inftrees.c file contains a vulnerability due to improper pointer arithmetic. This may allow context-dependent attackers to cause unspecified impacts.
Integer overflow in the rwpng_read_image24_libpng function in pngquant 2.7.0 may allow remote attackers to have unspecified impact via a crafted PNG file, leading to a buffer overflow.
Use-after-free vulnerability in V8 in Google Chrome before version 53.0.2785.143 allows remote attackers to cause a denial of service (crash) or possibly have unspecified other impact via unknown vectors.
The backend service process in Lenovo Solution Center (LSC) before version 3.3.0002 allows local users to gain SYSTEM privileges via unspecified vectors.
The 'from' method in library/core/class.email.php in Vanilla Forums before version 2.3.1 allows remote attackers to spoof the email domain in sent messages. This can lead to the potential acquisition of sensitive information via a crafted HTTP Host header, as demonstrated by a password reset request.
The GPU driver in Huawei P7 phones before versions P7-L00C17B851, P7-L05C00B851, and P7-L09C92B851 allows local users to read or write to arbitrary kernel memory locations, potentially leading to system crashes or privilege escalation via a crafted application.
PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.
The mDNS module in Huawei WLAN AC6005, AC6605, and ACU2 devices with software before V200R006C00SPC100 allows remote attackers to obtain sensitive information by leveraging failure to restrict processing of mDNS unicast queries to the link local network.
The Powerplay Gallery plugin version 3.3 for WordPress contains a vulnerability in upload.php that allows remote attackers to create arbitrary directories by manipulating the targetDir variable.
The MDC YouTube Downloader plugin version 2.1.0 for WordPress has an absolute path traversal vulnerability that allows remote attackers to read arbitrary files via a full pathname in the file parameter to includes/download.php.
Directory traversal vulnerability in the WP e-Commerce Shop Styling plugin before version 2.6 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter to includes/download.php.
Teradata Gateway versions before 15.00.03.02-1 and 15.10.x before 15.10.00.01-1, as well as TD Express before 15.00.02.08_Sles10 and 15.00.02.08_Sles11, allow remote attackers to cause a denial of service (database crash) via a malformed CONFIG REQUEST message.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS