CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In Lenovo ThinkServer TSM RD350, RD450, RD550, RD650, TD350, a reset to default settings may occur during a prolonged broadcast storm in TSM versions earlier than 3.77.
An information disclosure vulnerability in the logging implementation of BlackBerry Good Control Server versions earlier than 2.3.53.62 allows remote attackers to gain and use logged encryption keys to access certain resources within a customer's Good deployment.
The ReadVIFFImage function in ImageMagick before version 7.0.1-0 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
The check_allocations function in libass/ass_shaper.c in libass before version 0.13.4 allows remote attackers to cause a denial of service (memory allocation failure) via unspecified vectors.
Buffer overflow in the calc_coeff function in ass_blur.c in libass before version 0.13.4 allows remote attackers to cause a denial of service via unspecified vectors.
The wrap_lines_smart function in ass_render.c in libass before version 0.13.4 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to '0/3 line wrapping equalization.'
Dbclient in Dropbear SSH before version 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument.
Umbraco before version 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF) attacks, as demonstrated by editing user account information in the templates.asmx.cs file.
The Page_Load function in Umbraco before version 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks via the url parameter.
The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer node that is treated as a PLIST_KEY, leading to an invalid free.
libplist allows attackers to cause a denial of service through large memory allocation and crash via vectors involving an offset size of zero.
CVE-2017-5613 is a format string vulnerability in cgiemail and cgiecho that allows remote attackers to execute arbitrary code via format string specifiers in a template file.
Irssi before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a string containing a formatting sequence (%[) without a closing bracket (]).
Irssi versions 0.8.18 and earlier before 0.8.21 allow remote attackers to cause a denial of service (out-of-bounds read and crash) via vectors involving strings that are not UTF8.
Irssi versions 0.8.17 and earlier before 0.8.21 are vulnerable to an attack that can lead to denial of service through a crafted ANSI x8 color code causing an out-of-bounds read and application crash.
A use-after-free vulnerability in Irssi before version 0.8.21 allows remote attackers to cause a denial of service (crash) via an invalid nick message.
The nickcmp function in Irssi before version 0.8.21 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a message without a nick.
In version 1.12.0 of the mcollective-puppet-agent plugin on Windows installations, a non-administrator user can create an executable that will be executed with administrator privileges on the next 'mco puppet' run. Puppet Enterprise users are not affected.
CVE-2016-10206 is a CSRF vulnerability in Zoneminder 1.30 and earlier that allows remote attackers to hijack user authentication for requests that change passwords and possibly other unspecified impacts.
Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZMSESSID cookie.