CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.24)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Firejail before 0.9.44.4, when running a bandwidth command, allows local users to gain root privileges via the --shell argument.
The postrm script in the tomcat6, tomcat7, and tomcat8 packages on various versions of Debian and Ubuntu may allow local users with access to the tomcat account to gain root privileges via a setgid program in the Catalina directory.
The postinst script in the tomcat6, tomcat7, and tomcat8 packages on various versions of Debian and Ubuntu may allow local users with access to the tomcat account to obtain sensitive information or gain root privileges via a symlink attack on the Catalina localhost directory.
NDSD in Novell eDirectory before 9.0.2 did not calculate ACLs on LDAP objects across partition boundaries correctly, which could lead to a privilege escalation by modifying user attributes that would otherwise be filtered by an ACL.
A cross site request forgery protection mechanism in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be circumvented by repeated uploads causing a high load.
The presence of a .htaccess file in NetIQ Access Manager 4.1 before version 4.1.2 Hot Fix 1 and 4.2 before SP2 may lead to information leakage.
The SAML2 implementation in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 was handling unsigned SAML requests incorrectly, leaking results to a potentially malicious 'Assertion Consumer Service URL' instead of the original requester.
The certificate upload feature in iManager in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to upload JSP pages that would be executed as the iManager user, allowing code execution by logged-in remote users.
A vulnerability in cookie handling in the http stack implementation in NDSD in Novell eDirectory before 9.0.1 allows remote attackers to bypass intended access restrictions by leveraging predictable cookies.
A code injection vulnerability in the supportconfig data collection tool in supportutils in SUSE Linux Enterprise Server 12 and 12-SP1 and SUSE Linux Enterprise Desktop 12 and 12-SP1 could allow local attackers to execute code as the user running supportconfig (usually root).
A logged-in user in NetIQ Access Governance Suite versions 6.0 through 6.4 could escalate privileges to administrator.
An issue was discovered in cloudflare-scrape versions 1.6.6 to 1.7.1 that allows a malicious website owner to execute arbitrary Python code on any cfscrape user scraping that website.
A vulnerability in the DHCP client implementation of Cisco IOS and Cisco IOS XE could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. It occurs during the parsing of a crafted DHCP packet.
A vulnerability in the DHCP code for the Zero Touch Provisioning feature of Cisco ASR 920 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause an affected device to reload. This is due to a format string vulnerability when processing a crafted DHCP packet.
A vulnerability in the web framework of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation of HTTP parameters supplied by the user.
A vulnerability in the Layer 2 Tunneling Protocol (L2TP) parsing function of Cisco IOS and Cisco IOS XE could allow an unauthenticated, remote attacker to cause an affected device to reload. The issue is due to insufficient validation of L2TP packets.
A vulnerability in the web user interface of Cisco IOS XE 3.1 through 3.17 could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to insufficient resource handling by the affected software when the web user interface is under a high load.
A vulnerability in the Cisco application-hosting framework (CAF) component of the Cisco IOx application environment allows an authenticated, remote attacker to write or modify arbitrary files in the virtual instance running on the affected device. The vulnerability is due to insufficient input validation of user-supplied application packages.
A Directory Traversal vulnerability in the web framework code of the Cisco IOx application-hosting framework allows an unauthenticated remote attacker to read any file from the CAF in the virtual instance running on the affected device. The issue is due to insufficient input validation.
pngdefry through March 22, 2017 is prone to a heap-based buffer-overflow vulnerability because it fails to properly process a specially crafted png file. This issue affects the 'process()' function of the 'pngdefry.c' source file.