CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.25)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
BackBox Linux 4.6 allows remote attackers to cause a denial of service (ksoftirqd CPU consumption) via a flood of packets with Martian source IP addresses. The logging of these addresses is enabled by default.
The fill_threshhold_buffer function in base/gxht_thresh.c in Ghostscript 9.20 by Artifex Software, Inc. allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PostScript document.
Cistron-LG version 1.01 stores sensitive information under the web root with insufficient access controls, allowing remote attackers to obtain IP addresses and other unspecified router credentials.
The default configuration for Cougar-LG stores sensitive information under the web root with insufficient access control, which might allow remote attackers to obtain private ssh keys.
Technicolor TC7200 with firmware STD6.01.12 could allow remote attackers to obtain sensitive information.
Pulp before version 2.3.0 uses the same certificate authority key and certificate for all installations.
Incorrect interaction of the parse_packet() and parse_part_sign_sha256() functions in network.c in collectd 5.7.1 and earlier allows remote attackers to cause a denial of service (infinite loop) of a collectd instance (configured with 'SecurityLevel None' and with empty 'AuthFile' options) via a crafted UDP packet.
The dalvik_disassemble function in radare2 version 1.2.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted DEX file.
The _zval_get_long_func_ex function in PHP 7.1.2 has a vulnerability that allows attackers to cause a denial of service through crafted use of 'declare(ticks=' in a PHP script, leading to a NULL pointer dereference and application crash.
The relocs function in libr/bin/p/bin_bflt.c in radare2 version 1.2.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.
The parse_char_class function in regparse.c in the Onigmo (aka Oniguruma-mod) regular expression library, as used in Ruby 2.4.0, allows remote attackers to cause a denial of service (deep recursion and application crash) via a crafted regular expression.
YARA 3.5.0 has a vulnerability that allows remote attackers to cause a denial of service through a crafted rule mishandled in the yr_compiler_destroy function, leading to a use-after-free error and application crash.
YARA 3.5.0 has a vulnerability that allows remote attackers to cause a denial of service through a crafted rule, leading to a heap-based out-of-bounds read and application crash.
Devices Jensen of Scandinavia AS Air:Link 3G, Air:Link 5000AC, and Air:Link 59300 have a vulnerability that allows remote attackers to read passwords via a direct request to the x.asp page.
Devices Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC) version 1.13, and Air:Link 59300 (AL59300) version 1.04 (Rev. 4) are vulnerable to CSRF attacks that can be conducted by remote attackers via certain /goform/* pages.
JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 18, allows remote attackers to cause a denial of service via crafted JavaScript code mishandled in the operatorString function, leading to bitfield out-of-bounds read and application crash.
In JavaScriptCore in WebKit, included in Safari Technology Preview Release 18, there is a vulnerability that allows remote attackers to cause a denial of service through crafted JavaScript code. This issue involves 'type confusion' in the JSON.stringify function, leading to segmentation violation and application crash.
YARA 3.5.0 has a vulnerability that allows remote attackers to cause a denial of service through a crafted rule mishandled in the yr_parser_lookup_loop_variable function, leading to a use-after-free error and application crash.
In YARA 3.5.0, a vulnerability allows remote attackers to cause application crashes via a crafted rule, leading to a NULL pointer dereference in the yy_get_next_buffer function.
The register_routes function in the REST API of WordPress versions 4.7.x before 4.7.2 does not require an integer identifier, allowing remote attackers to modify arbitrary pages via a crafted request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS