CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT) affects versions 7u121 and 8u112. It allows an unauthenticated attacker with network access to compromise Java SE, requiring user interaction.
Vulnerability in the Java SE, Java SE Embedded, and JRockit components allows an unauthenticated attacker with network access to compromise these systems. Successful attacks can result in hangs or frequent crashes, leading to complete denial of service.
Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via HTTP to compromise the server. Successful attacks can lead to unauthorized access to data and cause a partial denial of service.
Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via LDAP to compromise the server. Successful attacks can lead to unauthorized access to data and partial denial of service.
The casrvc program in CA Common Services allows local users to modify arbitrary files, potentially gaining root privileges. This issue affects versions of CA Client Automation, CA SystemEDGE, CA Systems Performance, CA Universal Job Management Agent, CA Virtual Assurance, and CA Workload Automation across various operating systems.
A vulnerability in the Oracle FLEXCUBE Investor Servicing component allows a low privileged attacker with network access via HTTP to compromise the system. The attacker can unauthorizedly create, delete, or modify critical data and gain access to all data accessible in Oracle FLEXCUBE Investor Servicing.
Vulnerability in the Oracle FLEXCUBE Private Banking component allows an unauthenticated attacker with network access via HTTP to compromise the system. It requires interaction from a third party, which may lead to unauthorized access to critical data.
A vulnerability in the Oracle FLEXCUBE Universal Banking component allows unauthenticated attackers with HTTP network access to compromise the system. Attackers can gain unauthorized access to data and modify it.
A vulnerability in the Oracle FLEXCUBE Private Banking component allows a low privileged attacker with network access via HTTP to compromise the system. Successful attacks can lead to unauthorized creation, deletion, or modification of critical data.
A vulnerability in the Oracle FLEXCUBE Universal Banking component allows low privileged attackers with network access via HTTP to compromise the system. Attackers can unauthorizedly create, delete, or modify critical data.
An integer signedness error in the memset function in uClibc and uClibc-ng before version 1.0.16 can lead to system crashes. Attackers can exploit this vulnerability by passing a negative length value.
The icaltime_from_string function in libical versions 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted string to the icalparser_parse_string function.
The parser_get_next_char function in libical versions 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) by crafting a string to the icalparser_parse_string function.
Vulnerability in the MySQL Enterprise Monitor component of Oracle MySQL allows a high privileged attacker with network access via TLS to compromise MySQL Enterprise Monitor. Affected versions are 3.1.3.7856 and earlier.
Vulnerability in the Java SE, Java SE Embedded, and JRockit components allows unauthenticated attackers with network access to compromise these systems. Attackers can gain access to critical data, leading to unauthorized creation, deletion, or modification.
Huawei Oceanstor 5800 before version V300R002C10SPC100 is vulnerable to a denial of service attack that can lead to high CPU consumption. Attackers can exploit a large number of crafted HTTP packets to disrupt the system's operation.
The t2p_readwrite_pdf_image_tile function in LibTIFF allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a JPEG file with a TIFFTAG_JPEGTABLES of length one.
The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by setting the tags TIFF_SETGET_C16ASCII or TIFF_SETGET_C32_ASCII to values that access 0-byte arrays.
Incorrect HTTP Request header comparison in Squid HTTP Proxy versions 3.5.0.1 through 3.5.22 and 4.0.1 through 4.0.16 results in the Collapsed Forwarding feature mistakenly identifying some private responses as suitable for delivery to multiple clients.
Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy leads to client-specific Cookie data being leaked to other clients.