CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A memory leak in the login_user function in saslserv/main.c in Atheme 7.2.7 allows a remote unauthenticated attacker to consume memory and cause a denial of service. This issue is fixed in version 7.2.8.
The 'OpenID Connect Relying Party and OAuth 2.0 Resource Server' (mod_auth_openidc) module before version 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an 'OIDCUnAuthAction pass' configuration, allowing remote attackers to bypass authentication via crafted HTTP traffic.
An issue exists in PHP 5.x and 7.x related to OpCache that may lead to unauthorized access to compiled script code. This issue occurs in configurations using apache2handler/mod_php or php-fpm with OpCache enabled.
The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2 version 1.2.1 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted DEX file.
A vulnerability in the SCTP decoder of Cisco NetFlow Generation Appliance (NGA) devices with software before 1.1(1a) could allow an unauthenticated, remote attacker to cause the device to hang or unexpectedly reload, leading to a denial of service (DoS) condition. The issue is due to incomplete validation of SCTP packets being monitored on NGA data ports.
IBM Kenexa LCMS Premier versions 9.0 and 10.0.0 are vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, allowing them to view, add, modify, or delete information in the back-end database.
IBM Kenexa LCMS Premier versions 9.0 and 10.0.0 are vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, allowing them to view, add, modify, or delete information in the back-end database.
IBM Kenexa LCMS Premier versions 9.0 and 10.0.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, allowing them to view, add, modify, or delete information in the back-end database.
IBM QRadar 7.2 stores the encryption key used to encrypt the service account password, which can be obtained by a local user.
IBM QRadar 7.2 uses outdated hashing algorithms to hash certain passwords, which could allow a local user to obtain and decrypt user credentials.
The ip_cmsg_recv_checksum function in the Linux kernel before version 4.10.1 has incorrect expectations about skb data layout, allowing local users to cause a denial of service (buffer over-read) or potentially have unspecified other impact via crafted system calls.
A race condition in the Linux kernel before version 4.9.13 in net/packet/af_packet.c allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a multithreaded application making PACKET_FANOUT setsockopt system calls.
The LLC subsystem in the Linux kernel before version 4.9.13 does not ensure that a certain destructor exists in required circumstances, allowing local users to cause a denial of service (BUG_ON) or possibly have unspecified other impact via crafted system calls.
The NetApp ONTAP Select Deploy administration utility versions 2.0 through 2.2.1 may allow remote attackers to obtain sensitive information via unspecified vectors.
The __construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value.
NetApp Data ONTAP versions 9.0 and 9.1 before 9.1P1 allow remote authenticated users who own SMB-hosted data to bypass intended sharing restrictions by leveraging improper handling of the owner_rights ACL entry.
The hesiod_init function in lib/hesiod.c in Hesiod 3.2.1 compares EUID with UID, allowing local users to gain privileges via the HESIOD_CONFIG or HES_DOMAIN environment variable and leveraging certain SUID/SGUID binaries.
Siemens SINUMERIK Integrate Operate Clients in versions from 2.0.3.00.016 to 2.0.6 (exclusive) and from 3.0.4.00.032 to 3.0.6 (exclusive) contain a vulnerability that could allow an attacker to read and manipulate data in TLS sessions while performing a man-in-the-middle (MITM) attack.
In PoDoFo 0.9.4, there is a heap-based buffer overflow in the PoDoFo::PdfTokenizer::GetNextToken function, allowing remote attackers to have unspecified impact via a crafted file.
Integer overflow in base/PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.