CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unspecified vulnerability in Zimbra Collaboration before version 8.7.0 allows remote attackers to affect confidentiality via unknown vectors.
RESTful web services in CA Service Desk Manager 12.9 and CA Service Desk Management 14.1 may allow remote authenticated users to read or modify task information due to incorrect permissions applied to a RESTful request.
A directory traversal vulnerability in the wp_ajax_update_plugin function in WordPress 4.5.3 allows remote authenticated users to cause a denial of service or read certain text files via a .. (dot dot) in the plugin parameter to wp-admin/admin-ajax.php.
The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via crafted TIFF_SETGET_C16ASCII or TIFF_SETGET_C32_ASCII tag values.
A use-after-free vulnerability in the fimg2d driver for Android on Exynos 5433, 54xx, or 7420 chipsets allows attackers to obtain sensitive information via unspecified vectors.
MuJS by Artifex Software allows attackers to cause a denial of service (crash) via vectors related to incomplete escape sequences. This vulnerability exists due to an incomplete fix for CVE-2016-7563.
The valider_xml.php file in SPIP version 3.1.2 and earlier allows remote attackers to conduct server side request forgery (SSRF) attacks via a URL in the var_url parameter in a valider_xml action.
The SPIP template composer/compiler in version 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading an HTML file with a crafted INCLUDE or INCLURE tag and then accessing it with a valider_xml action.
The WPG format reader in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (assertion failure and crash) via vectors related to a ReferenceBlob and a NULL pointer.
Directory traversal vulnerability in valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to enumerate files on the system via the var_url parameter in a valider_xml action.
A CSRF vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that execute the XML validator on a local file via a crafted valider_xml request.
A heap-based buffer overflow in the Fp_toString function in jsfunction.c in Artifex Software MuJS can lead to a denial of service (crash) via crafted input.
The chartorune function in Artifex Software MuJS allows attackers to cause a denial of service (out-of-bounds read) via a * (asterisk) at the end of the input.
The m_authenticate function in UnrealIRCd before 3.2.10.7 and 4.x before 4.0.6 allows remote attackers to spoof certificate fingerprints, enabling them to log in as another user via a crafted AUTHENTICATE parameter.
Integer overflow in the BMP coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (crash) via crafted height and width values, which triggers an out-of-bounds write.
The SmartCall Activity component in the Telecom application on Samsung Note devices L(5.0/5.1) and M(6.0) allows attackers to cause a denial of service (crash and reboot) or possibly gain privileges via a malformed serializable object.
The SpamCall Activity component in Telecom application on Samsung Note device L (5.0/5.1) and M (6.0) allows attackers to cause a denial of service (crash and reboot) or possibly gain privileges via a malformed serializable object.
A stack-based buffer overflow in the inbound_cap_ls function in common/inbound.c in HexChat 2.10.2 allows remote IRC servers to cause a denial of service (crash) by sending a large number of options in a CAP LS message.
Directory traversal vulnerability in the client in HexChat 2.11.0 allows remote IRC servers to read or modify arbitrary files via a .. (dot dot) in the server name.
An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.