CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in the system management of certain FireAMP processes in Cisco FireAMP Connector Endpoint software allows an authenticated, local attacker to stop certain protected FireAMP processes without requiring a password. Stopping critical processes could lead to a denial of service (DoS) condition and loss of certain security features.
CVE-2016-2334 describes a heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before version 16.00 and p7zip. This allows remote attackers to execute arbitrary code via a crafted HFS+ image.
A vulnerability in mysqld_safe in Oracle MySQL and other databases allows local users with access to the mysql account to gain root privileges via a symlink attack on error logs and possibly other files.
A race condition vulnerability exists in Oracle MySQL, MariaDB, Percona Server, and Percona XtraDB Cluster that allows local users with certain permissions to gain elevated privileges. The issue involves the use of my_copystat during REPAIR TABLE on a MyISAM table.
X.org libXtst before 1.2.3 allows remote X servers to cause a denial of service (infinite loop) via a reply in the XRecordStartOfData, XRecordEndOfData, or XRecordClientDied category without a client sequence and with attached data.
LibXi versions before 1.7.7 allow remote X servers to cause a denial of service via an infinite loop involving length fields.
Multiple integer overflows in X.org libXi before version 1.7.7 allow remote X servers to cause a denial of service through out-of-bounds memory access or infinite loops, using length fields.
CVE-2016-6706 is a vulnerability in libstagefright in Mediaserver in Android 7.0 before 2016-11-01 that allows a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High due to the potential for gaining local access to elevated capabilities not normally accessible to third-party applications.
CVE-2016-6699 is a remote code execution vulnerability in libstagefright in Mediaserver in Android 7.0 before November 1, 2016. An attacker can exploit a specially crafted file to cause memory corruption during media file processing.
The igdkmd64 module in the Intel Graphics Driver through version 15.33.42.435, 15.36.x through 15.36.30.4385, and 15.40.x through 15.40.4404 on Windows allows local users to cause a denial of service (crash) or gain privileges via a crafted D3DKMTEscape request.
The ProcPutImage function in X.Org Server before version 1.16.4 allows attackers to cause a denial of service via a zero-height PutImage request, leading to a divide-by-zero error and server crash.
PCRE versions 7.8 through 8.37 and PCRE2 version 10.10 mishandle empty group matches, which may allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression.
Buffer overflow in the Get8BIMProperty function in ImageMagick before version 6.9.5-4 and 7.x before version 7.0.2-6 allows remote attackers to cause a denial of service via a crafted image.
In ImageMagick before version 7.0.2-1, a vulnerability allows remote attackers to obtain sensitive memory information via vectors involving the q variable, which triggers an out-of-bounds read.
The WPG parser in ImageMagick before version 6.9.4-4 and 7.x before version 7.0.1-5, when a memory limit is set, allows remote attackers to have unspecified impact via issues related to the SetImageExtent return-value check. This can lead to a heap-based buffer overflow in the SetPixelIndex function or an invalid write operation in the ScaleCharToQuantum or SetPixelIndex functions.
An issue was discovered in Asterisk Open Source versions 13.12.x, 13.13.x before 13.13.1, and 14.x before 14.2.1 related to the handling of the Opus codec. Receiving an SDP offer or answer with format parameters separated by spaces causes the code to recursively call itself, leading to a crash.
An issue was discovered in w3m before version 0.5.3-31 related to a buffer overflow in the formUpdateBuffer function. Remote attackers can cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML page.
An issue was discovered in w3m before version 0.5.3-31 related to a heap-based buffer overflow in the addMultirowsForm function. This allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML page.
An issue was discovered in the Tatsuya Kinoshita w3m fork before version 0.5.3-31. Integer overflow vulnerability in the renderTable function in w3m allows remote attackers to cause a denial of service (OOM) and possibly execute arbitrary code via a crafted HTML page.
An issue was discovered in the w3m fork before version 0.5.3-31, involving a heap-based buffer overflow in the addMultirowsForm function. This allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML page.