CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.24)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2017-5899 describes a directory traversal vulnerability in the setuid root helper binary in S-nail (later S-mailx) before version 14.8.16. This allows local users to write to arbitrary files, potentially gaining root privileges.
httpd in OpenBSD allows remote attackers to cause a denial of service (memory consumption) via a series of requests for a large file using an HTTP Range header.
Versions of ark before 16.12.1 might allow remote attackers to execute arbitrary code via an executable in an archive, related to associated applications.
Heap-based buffer overflow in the verify_vbr_checksum function in exfatfsck in exfat-utils before version 1.2.1 allows remote attackers to cause a denial of service (infinite loop) or possibly execute arbitrary code via a crafted filesystem.
A stack-based buffer overflow in the firmware of Broadcom Wi-Fi HardMAC SoC chips occurs when the firmware supports CCKM Fast and Secure Roaming and the feature is enabled in RAM. This allows remote attackers to execute arbitrary code via a crafted reassociation response frame with a Cisco IE (156).
Subrion CMS version 4.0.5 has a CSRF vulnerability in the admin/blog/add/ module. An attacker can add any tag and optionally inject XSS via the tags parameter.
Subrion CMS version 4.0.5 has a CSRF vulnerability in the admin/blocks/add/ module that allows an attacker to create any blocks. Additionally, the attacker can optionally inject XSS via the content parameter.
Subrion CMS version 4.0.5 has a CSRF vulnerability in the language editing module. An attacker can perform any Edit Language action and optionally inject XSS via the title parameter.
Subrion CMS version 4.0.5.10 has a CSRF vulnerability in the admin/blog/add/ module. An attacker can add any blog entry and optionally inject XSS via the body parameter.
The bm_readbody_bmp function in bitmap_io.c in Potrace 1.14 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted BMP image.
Multiple stack buffer overflow vulnerabilities in Air:Link 3G, Air:Link 5000AC, and Air:Link 59300 devices allow remote attackers to execute arbitrary code or crash the web service.
LibTIFF version 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted TIFF image.
LibTIFF version 4.0.7 contains a vulnerability that allows remote attackers to cause a denial of service through a crafted TIFF image. The issue relates to buffer over-read and buffer overflow errors.
LibTIFF version 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image.
LibTIFF versions from 4.0.0alpha4 to 4.0.7 allow remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image.
LibTIFF version 4.0.7 contains a vulnerability that allows remote attackers to cause a denial of service through a crafted TIFF image. The issue relates to an integer underflow and heap-based buffer under-read.
Eclipse tinydtls version 0.8.2 for Eclipse IoT allows remote attackers to cause a denial of service (DTLS peer crash) by sending a 'Change cipher spec' packet without pre-handshake.
An issue was discovered on Miele Professional PST10 devices related to a directory traversal attack. An unauthenticated attacker may gain access to sensitive information, aiding in subsequent attacks.
The coders/psd.c in ImageMagick has a vulnerability that allows remote attackers to have unspecified impact via a crafted PSD file, leading to an out-of-bounds write.
The coders/psd.c file in ImageMagick contains a vulnerability that allows remote attackers to have unspecified impact via a crafted PSD file, leading to an out-of-bounds write.