CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An issue was discovered in certain Apple products related to the 'CoreGraphics' component. iOS versions before 10.1, macOS before 10.12.1, tvOS before 10.0.1, and watchOS before 3.1 are vulnerable to attacks that can lead to arbitrary code execution or application crashes.
An issue was discovered in certain Apple products, including macOS before 10.12.1, involving the 'ImageIO' component. It allows remote attackers to execute arbitrary code or cause application crashes via a crafted PDF file.
An issue was discovered in certain Apple products, including iOS before 10.1, macOS before 10.12.1, tvOS before 10.0.1, and watchOS before 3.1, related to the 'Kernel' component. It allows local users to execute arbitrary code in a privileged context or cause a denial of service via unspecified vectors.
An issue was discovered in certain Apple products, including macOS before 10.12.1, involving the 'ATS' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted font.
An issue was discovered in certain Apple products, including iOS before 10.1, Safari before 10.0.1, and tvOS before 10.0.1, related to the 'WebKit' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.
An issue was discovered in certain Apple products, including macOS before 10.12.1, involving the 'AppleGraphicsControl' component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
An issue was discovered in certain Apple products related to the 'FontParser' component. Affects iOS before 10.1, macOS before 10.12.1, tvOS before 10.0.1, and watchOS before 3.1. This issue allows remote attackers to obtain sensitive information or cause a denial of service via a crafted font.
An issue was discovered in certain Apple products, including macOS before 10.12, involving a sandbox escape related to launchctl process spawning in the 'libxpc' component.
The dccp_rcv_state_process function in the Linux kernel through version 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures in the LISTEN state, allowing local users to obtain root privileges or cause a denial of service (double free) via an application making an IPV6_RECVPKTINFO setsockopt system call.
A race condition in the Linux kernel before version 4.9.7 in kernel/events/core.c allows local users to gain privileges via a crafted application making concurrent perf_event_open system calls to move a software group into a hardware context.
SQL injection vulnerability in GeniXCMS through version 1.0.2 allows remote authenticated users to execute arbitrary SQL commands via the 'order' parameter.
The XXE vulnerability in eParakstitajs 3 before version 1.3.9 and eParaksts Java lib before version 2.5.13 allows remote attackers to read arbitrary files or possibly have unspecified other impact via a crafted edoc file.
Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.
The WRITE_UNALIGNED function in dwarf_elf_access.c in libdwarf before version 20160923 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a crafted DWARF section.
The dwarf_dealloc function in libdwarf before version 20160923 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted DWARF section.
The dwarf_get_aranges_list function in libdwarf before version 20160923 allows remote attackers to cause a denial of service (infinite loop and crash) via a crafted DWARF section.
libdwarf before version 20160923 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a large length value in a compilation unit header.
The get_attr_value function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted object with all-bits on.
The dwarf_get_macro_startend_file function in libdwarf before version 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted string offset for .debug_str.
The dump_block function in print_sections.c in libdwarf before version 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via crafted frame data.