CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.24)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface in the Scheduler in SolarWinds FTP Voyager 16.2.0 allow remote attackers to hijack the authentication of users for requests that change the admin password or terminate the scheduler.
The vulnerability in saned in sane-backends 1.0.25 allows remote attackers to obtain sensitive memory information via a crafted SANE_NET_CONTROL_OPTION packet.
The IofCallDriver function in USBPcap 1.1.0.0 allows local users to gain privileges via a crafted 0x00090028 IOCTL call, which triggers a NULL pointer dereference.
Buffer overflow in NetRxPkt::ehdr_buf in QEMU when the VLANSTRIP feature is enabled on the vmxnet3 device allows remote attackers to cause a denial of service via out-of-bounds access, leading to a QEMU process crash.
GNU screen before 4.5.1 allows local users to modify arbitrary files and consequently gain root privileges by leveraging improper checking of logfile permissions.
IBM WebSphere Application Server versions 8.0, 8.5, 8.5.5, and 9.0 using OpenID Connect (OIDC) configured with a Trust Association Interceptor (TAI) could allow a user to gain elevated privileges on the system.
IBM WebSphere MQ version 8.0.0.6 does not properly terminate channel agents when they are no longer needed, which could allow a user to cause a denial of service through resource exhaustion.
IBM Reliable Scalable Cluster Technology could allow a local user to escalate their privileges to gain root access.
The get_sessions servlet in CA Unified Infrastructure Management (formerly CA Nimsoft Monitor) before version 8.5 and CA Unified Infrastructure Management Snap (formerly CA Nimsoft Monitor Snap) allows remote attackers to obtain active session ids, enabling them to bypass authentication or gain privileges via unspecified vectors.
The Qualcomm SPCom driver in Android before 7.0 allows local users to execute arbitrary code within the context of the kernel via a crafted application.
Integer overflow in the _IO_wstr_overflow function in the GNU C Library (glibc) before version 2.22 can lead to application crashes or potentially allow arbitrary code execution. Attackers can exploit this vulnerability by manipulating size calculations in bytes, triggering a heap-based buffer overflow.
ImageMagick version 6.8.9.9 allows remote attackers to cause application crashes, leading to denial of service.
A logic error in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (resource consumption).
The png coder in ImageMagick allows remote attackers to cause a denial of service (crash).
A memory leak in ImageMagick can be exploited by remote attackers to cause a denial of service through excessive memory consumption.
A memory leak in the ReadPSDLayers function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.
Libavcodec in FFmpeg before version 0.11 allows remote attackers to execute arbitrary code via a crafted WMV file.
The sg_ioctl function in the Linux kernel through version 4.10.4 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function.
libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service by triggering an invalid Unicode property lookup, leading to segmentation violation and application crash.
The git-prompt.sh script in Git before version 1.9.3 does not sanitize branch names in the PS1 variable, allowing malicious repositories to execute code.