CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a crafted series of skip and count pairs.
In ntpd versions before 4.2.8p9, when running on Windows, there is a vulnerability that allows remote attackers to cause a denial of service by sending a large UDP packet.
The OTR plugin for Gajim sends information in cleartext when using XHTML, allowing remote attackers to obtain sensitive information.
The read_mru_list function in NTP before version 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a crafted mrulist query.
NTP versions before 4.2.8p9 rate limit responses received from configured sources when rate limiting for all associations is enabled. This allows remote attackers to cause a denial of service by sending responses with a spoofed source address.
The pstm_reverse function in MatrixSSL before version 3.8.4 allows remote attackers to cause a denial of service (invalid memory read and crash) via a zero value or the key's modulus for the secret key during RSA key exchange.
The pstm_exptmod function in MatrixSSL before 3.8.4 allows remote attackers to cause a denial of service (invalid free and crash) via a base zero value for the modular exponentiation.
Memory corruption vulnerability in Foxit PDF Toolkit v1.3 allows an attacker to cause Denial of Service and Remote Code Execution when the victim opens a specially crafted PDF file.
An issue was discovered in Cloud Foundry prior to version v250 and CAPI-release prior to v1.12.0 related to logging credentials returned from service brokers. These credentials are logged in Cloud Controller system component logs and often sent to a log aggregator via syslog.
CVE-2016-3130 is an information disclosure vulnerability in BlackBerry Enterprise Server (BES) 12 through 12.5.2 that allows remote attackers to obtain local or domain credentials of an administrator or user account by sniffing traffic between the management console and the server during a login attempt.
CVE-2016-3128 is a vulnerability in BlackBerry Enterprise Server (BES) 12 through 12.5.2 that allows remote attackers to enroll an illegitimate device, gain access to device parameters, or send false information by exploiting data from a legitimately enrolled device.
An information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 and v1.29, allowing a remote unauthenticated attacker to browse all directories in the web root.
An issue was discovered on BLU R1 HD devices with Shanghai Adups software related to the com.adups.fota and com.adups.fota.sysoper apps. The com.adups.fota.sysoper app runs as the system user, granting it numerous permissions, including access to the user's call log, text messages, and device identifiers.
An issue was discovered on BLU Advance 5.0 and BLU R1 HD devices with Shanghai Adups software related to the com.adups.fota.sysoper app, which operates as a system app. This app has an exported broadcast receiver, allowing other apps to interact with it and execute commands with system user privileges.
An issue was discovered on BLU R1 HD devices with Shanghai Adups software that allows apps to access files as the system user. The com.adups.fota.sysoper app enables other apps to read, write, and delete files, including users' text messages and call logs.
An issue was discovered on BLU R1 HD devices with Shanghai Adups software that allows apps to access files as the system user. The com.adups.fota.sysoper app sets the android:sharedUserId attribute to android.uid.system, enabling other apps to read, write, and delete system files.
The MT6573FDVT_SetRegHW function in camera_fdvt.c in the MediaTek driver for Linux allows local users to gain privileges via a crafted application that makes an MT6573FDVTIOC_T_SET_FDCONF_CMD IOCTL call.
There is a directory traversal vulnerability in the wallpaper parsing functionality in Barco ClickShare CSC-1, CSM-1, and CSE-200 devices that allows remote attackers to read the /etc/shadow file. This affects firmware versions before 01.09.03 for CSC-1, before 01.06.02 for CSM-1, and before 01.03.02 for CSE-200.
There is a privilege escalation vulnerability in Lenovo XClarity Administrator prior to version 1.2.0. Authenticated users may access log files that contain passwords for internal administrative LXCA accounts with temporary passwords.
CVE-2017-0404 is a privilege escalation vulnerability in the kernel sound subsystem that could allow a local malicious application to execute arbitrary code within the kernel context. This issue is rated as High because it first requires compromising a privileged process.