CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.24)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
GNU linker (ld) w GNU Binutils 2.28 zawiera podatność na przepełnienie bufora sterty podczas przetwarzania nieprawidłowego skryptu wejściowego, co prowadzi do awarii programu. Problem wynika z braku znaku końca '\0' w polu nazwy w pliku ldlex.l.
The find_nearest_line function in addr2line in GNU Binutils 2.28 does not handle the case where both the main file name and the directory name are empty, leading to a NULL pointer dereference and an invalid write, resulting in a program crash.
GNU assembler in GNU Binutils 2.28 is vulnerable to a global buffer overflow (of size 1) while attempting to unget an EOF character from the input stream, potentially leading to a program crash.
AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow remote authenticated users to execute arbitrary commands in a privileged context or launch a reverse shell via vectors involving the PHP session ID and the NfSen PHP code.
AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow local users to execute arbitrary commands in a privileged context via an NfSen socket.
The magick/colormap-private.h file in ImageMagick 6.8.9-9 contains a vulnerability that allows remote attackers to cause a denial of service through out-of-bounds access.
Heap overflow in ImageMagick 6.8.9-9 via a crafted wpf file.
Heap overflow in ImageMagick 6.8.9-9 via a crafted pict file.
Heap overflow in ImageMagick 6.8.9-9 via a crafted psd file.
Heap overflow in ImageMagick 6.8.9-9 via a crafted pcx file.
CSRF exists on D-Link DIR-600M Rev. Cx devices before v3.05ENB01_beta_20170306. This can be used to bypass authentication and insert XSS sequences or possibly have unspecified other impact.
A vulnerability in the Autonomic Networking Infrastructure (ANI) registrar feature of Cisco IOS and Cisco IOS XE software could allow an unauthenticated attacker to cause a denial of service (DoS) condition. The issue is due to incomplete input validation on certain crafted packets.
An SSL Stripping vulnerability in EMC RecoverPoint versions prior to 5.0 and EMC RecoverPoint for Virtual Machines versions prior to 5.0 allows attackers to intercept and modify SSL traffic, potentially compromising the affected system.
A Cross-Site Request Forgery issue was identified in Meteocontrol WEB'log (all versions). The lack of CSRF token generation per page or function increases the risk of attacks.
The decode_residual function in libavcodec in libav 9.21 allows remote attackers to cause a denial of service (buffer over-read) or obtain sensitive information from process memory via a crafted h264 video file.
The ff_h2645_extract_rbsp function in libavcodec in libav 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read) or obtain sensitive information from process memory via a crafted h264 video file.
CVE-2016-4929 in Junos Space before version 15.2R2 contains a vulnerability that allows attackers to execute arbitrary code as a root user.
CVE-2016-4928 is a cross-site request forgery vulnerability in Junos Space before version 15.2R2 that allows remote attackers to perform certain administrative actions.
Insufficient validation of SSH keys in Junos Space before version 15.2R2 allows man-in-the-middle (MITM) type attacks while a Space device is communicating with managed devices.
The code in Apache Tomcat versions from 6.0.0 to 9.0.0.M11 allowed parsing of the HTTP request line with invalid characters. This could be exploited in conjunction with a proxy that also accepted these characters to inject data into the HTTP response.