CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.24)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A memory leak in ImageMagick before version 6.9.7-4 and 7.x before version 7.0.4-4 in coders/mpc.c allows remote attackers to cause a denial of service (memory consumption) via vectors involving a pixel cache.
A double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file.
The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certificate.
Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection.
The __read_etc_hosts_r function in uClibc-ng before version 1.0.12 allows remote DNS servers to cause a denial of service (infinite loop) via a crafted packet.
The __decode_dotted function in libc/inet/resolv.c in uClibc-ng before version 1.0.12 allows remote DNS servers to cause a denial of service (infinite loop) via vectors involving compressed items in a reply.
Multiple memory leaks in the caption and label handling code in ImageMagick allow remote attackers to cause a denial of service via unspecified vectors.
The MuJS library from Artifex Software, Inc. has a vulnerability that allows attackers to cause a system crash via NULL pointer dereference during regular expression compilation.
The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line.
EyesOfNetwork (EON) version 5.0 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the selected_events[] parameter in the (1) acknowledge, (2) delete, or (3) ownDisown function in module/monitoring_ged/ged_functions.php or the (4) module parameter to module/index.php.
CVE-2017-5869 describes a vulnerability in the file import feature in Nuxeo Platform 6.0, 7.1, 7.2, and 7.3 that allows for directory traversal. Remote authenticated users can upload and execute arbitrary JSP code by exploiting the .. (dot dot) sequence in the X-File-Name header.
The XXE vulnerability in PySAML2 version 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.
The editbanner feature in SolarWinds LEM (also known as SIEM) up to version 6.3.1 allows remote authenticated users to execute arbitrary code by editing /usr/local/contego/scripts/mgrconfig.pl.
SolarWinds LEM (also known as SIEM) before version 6.3.1 has an incorrect sudo configuration, allowing local users to gain root access by editing /usr/local/contego/scripts/hostname.sh.
MediaWiki versions before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library. This allows remote attackers to read arbitrary files via an @ (at sign) character in unspecified POST array parameters.
The User::matchEditToken function in MediaWiki before version 1.23.12 and 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does not perform token comparison in constant time, allowing remote attackers to guess the edit token and bypass CSRF protection via a timing attack.
The User::matchEditToken function in MediaWiki before 1.23.12 and 1.24.x before 1.24.5 does not perform token comparison in constant time, allowing remote attackers to guess the edit token and bypass CSRF protection via a timing attack.
The calcstepsizes function in jpc_dec.c in JasPer 1.900.22 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.
The jpc_floorlog2 function in jpc_math.c in JasPer before version 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.
The jpc_dequantize function in jpc_dec.c in JasPer 1.900.13 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.