CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple use-after-free vulnerabilities in the gx_image_enum_begin function in base/gxipixel.c in Ghostscript before ecceafe3abba2714ef9b432035fe0739d9b1a283 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PostScript document.
Use-after-free vulnerability in pcsc-lite before version 1.8.20 allows remote attackers to cause denial of service (crash) via a command that uses 'cardsList' after the handle has been released through the SCardReleaseContext function.
tcpdf versions before 6.2.0 have a vulnerability that allows files from the server generating PDF files to be uploaded to an external FTP server.
The tcp_splice_read function in the Linux kernel before version 4.9.11 allows remote attackers to cause a denial of service through the use of a TCP packet with the URG flag, leading to an infinite loop and soft lockup.
IBM Rhapsody DM versions 4.0, 5.0, and 6.0 is vulnerable to a denial of service due to an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or exhaust all available memory resources.
D-Link DGS-1510-28XMP, DGS-1510-28X, DGS-1510-52X, DGS-1510-52, DGS-1510-28P, DGS-1510-28, and DGS-1510-20 Websmart devices with firmware before 1.31.B003 are vulnerable to Unauthenticated Information Disclosure attacks via unspecified vectors.
Vulnerability in OpenText Documentum Content Server 7.3, when using PostgreSQL Database and the return_top_results_row_based config option is set to false, allows improper restriction of DQL hints. This enables remote authenticated users to conduct DQL injection attacks and execute arbitrary DML or DDL commands via a crafted request.
The route manager in FlightGear before version 2016.4.4 allows remote attackers to write to arbitrary files via a crafted Nasal script.
Integer overflow in the mem_check_range function in the Linux kernel before version 4.9.10 allows local users to cause a denial of service (memory corruption) and obtain sensitive information from kernel memory.
The installPackage function in the installerHelper subcomponent in Libmacgpg in GPG Suite before version 2015.06 allows local users to execute arbitrary commands with root privileges via shell metacharacters in the xmlPath argument.
A vulnerability in the web interface of the Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to disclose sensitive information.
An HTTP Packet Processing vulnerability in the Web Bridge interface of the Cisco Meeting Server (CMS) could allow an authenticated, remote attacker to retrieve memory contents, potentially leading to the disclosure of confidential information. The attacker could also cause the application to crash unexpectedly, resulting in a denial of service (DoS) condition.
A vulnerability in the sponsor portal of Cisco Identity Services Engine (ISE) allows an authenticated, remote attacker to access notices owned by other users due to SQL Injection.
A vulnerability in an internal API of the Cisco Meeting Server (CMS) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the affected appliance.
An exploitable denial-of-service vulnerability exists in the fabric-worker component of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause the server process to dereference a null pointer.
Multiple cross-site request forgery (CSRF) vulnerabilities in the DIGISOL DG-HR1400 Wireless Router with firmware 1.00.02 allow remote attackers to hijack the authentication of administrators for requests that change the SSID or Wi-Fi password.
The Plug-in for VMware vCenter in VCE Vision Intelligent Operations before version 2.6.5 sends a cleartext HTTP response upon a request for the Settings screen, allowing remote attackers to discover the admin user password by sniffing the network.
A SQL injection vulnerability was discovered in the Mail Masta plugin version 1.0 for WordPress, identified in the file /inc/campaign_save.php. It requires authentication to the WordPress admin panel and utilizes the POST parameter: list_id.
The Mail Masta plugin (also known as mail-masta) version 1.0 for WordPress has a SQL injection issue. This issue affects the /inc/campaign/count_of_send.php file and requires authentication to the WordPress admin panel, using the POST parameter: camp_id.
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability. The issue occurs in the /inc/lists/view-list.php file, which requires authentication to the WordPress admin panel, using the GET parameter: filter_list.