CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) implementation of the SubmitCommandVirtual DDI, where untrusted input is used to reference memory outside of the intended boundary of the buffer. This can lead to denial of service or escalation of privileges.
All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscapeID 0x100008b where user provided input is used as the limit for a loop. This may lead to denial of service or potential escalation of privileges.
The NVIDIA GPU Display Driver R378 contains a vulnerability in the kernel mode layer handler that may lead to improper access control.
All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where multiple integer overflows may cause improper memory allocation leading to a denial of service or potential escalation of privileges.
All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where untrusted input is used for buffer size calculation leading to denial of service or escalation of privileges.
The AcquireQuantumPixels function in ImageMagick before version 7.0.3-1 allows remote attackers to have unspecified impact via a crafted image file, triggering a memory allocation failure.
A vulnerability in the web-based GUI of Cisco UCS Director 6.0.0.0 and 6.0.0.1 allows an authenticated local attacker to execute arbitrary workflow items using just an end-user profile. The issue is due to improper role-based access control (RBAC) after Developer Mode is enabled.
The SAP Message Server HTTP daemon in SAP KERNEL 7.21-7.49 allows remote attackers to cause a denial of service (memory consumption and process crash) via multiple msgserver/group?group= requests with a crafted size of the group parameter.
Openpyxl version 2.4.1 resolves external entities by default, allowing remote attackers to conduct XXE attacks via a crafted .xlsx document.
A stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_tsfb.c in JasPer before version 1.900.30 allows remote attackers to exploit it via a crafted image.
IBM AIX versions 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the bellmail client.
The AcquireMagickMemory function in ImageMagick 7.0.3.3 before 7.0.3.8 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure.
The AcquireMagickMemory function in ImageMagick before version 7.0.3.3 allows remote attackers to have unspecified impact via a crafted image, triggering a memory allocation failure.
A double free vulnerability in the mem_close function in jas_stream.c in JasPer before version 1.900.10 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image to the imginfo command.
The read_Header function in archive_read_support_format_7zip.c in libarchive 3.2.1 allows remote attackers to cause a denial of service (out-of-bounds read) via multiple EmptyStream attributes in a header in a 7zip archive.
A stack-based buffer overflow in the safe_fprintf function in tar/util.c in libarchive 3.2.1 allows remote attackers to cause a denial of service via a crafted non-printable multibyte character in a filename.
The MagickMalloc function in GraphicsMagick 1.3.25 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure and a 'file truncation error for corrupt file.'
The ReadPCXImage function in GraphicsMagick 1.3.25 allows remote attackers to have unspecified impact via a crafted image, triggering a memory allocation failure and a file truncation error for corrupt file.
The ReadSCTImage function in GraphicsMagick 1.3.25 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted SCT header.
slock allows attackers to bypass the screen lock via vectors involving an invalid password hash, which triggers a NULL pointer dereference and crash.