CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Funkcja kex_input_kexinit w pliku kex.c w OpenSSH w wersjach 6.x i 7.x do 7.3 umożliwia zdalnym atakującym spowodowanie odmowy usługi (zużycie pamięci) poprzez wysyłanie wielu duplikatów żądań KEXINIT. Zgłoszono, że zespół OpenSSH nie traktuje tego jako problemu bezpieczeństwa.
A race condition in the ion_ioctl function in the Linux kernel before version 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) by calling ION_IOC_FREE on two CPUs simultaneously.
In the Linux kernel before version 4.0, a vulnerability allows local users to bypass the 'strict page permissions' protection mechanism and modify the system-call table, potentially gaining elevated privileges.
In the Linux kernel before version 4.4, there is a vulnerability that allows local users to gain elevated privileges via crafted F_OFD_GETLK, F_OFD_SETLK, or F_OFD_SETLKW commands in an fcntl64 system call.
In Roundcube versions before 1.1.7 and 1.2.x before 1.2.3, the lack of SMTP server configuration and the enabling of the sendmail program does not properly restrict the use of custom envelope-from addresses on the sendmail command line. This allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message.
The icmp6_send function in the Linux kernel up to version 4.8.12 omits a certain check of the dst data structure, allowing remote attackers to cause a denial of service (panic) via a fragmented IPv6 packet.
CVE-2016-8102 describes an unquoted service path vulnerability in Intel Wireless Bluetooth Drivers 16.x, 17.x, and before 18.1.1607.3129, allowing local users to launch processes with elevated privileges.
In BlueZ 5.42, an out-of-bounds read was identified in the 'packet_hexdump' function in the 'monitor/packet.c' source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.
In BlueZ 5.42, a buffer overflow was observed in the 'read_n' function in the 'tools/hcidump.c' source file. This issue can be triggered by processing a corrupted dump file, resulting in hcidump crash.
In MapServer before version 7.0.3, OGR driver error messages are too verbose and may leak sensitive information if data connection fails.
A race condition in the Linux kernel through version 4.8.12 in net/packet/af_packet.c allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging the CAP_NET_RAW capability to change a socket version.
Integer overflow in tools/bmp2tiff.c in LibTIFF before 4.0.4 allows remote attackers to cause a denial of service (heap-based buffer over-read), or possibly obtain sensitive information from process memory, via crafted width and length values in RLE4 or RLE8 data in a BMP file.
The mod_http2 module in Apache HTTP Server versions 2.4.17 to 2.4.23 does not restrict request-header length when the Protocols configuration includes h2 or h2c. This allows remote attackers to cause a denial of service via crafted CONTINUATION frames in an HTTP/2 request.
A vulnerability in Siemens SICAM PAS (all versions before V8.09) allows a remote attacker to upload, download, or delete files in certain parts of the file system by sending specially crafted packets to port 19235/TCP.
In BMC Patrol before version 9.13.10.02, the binary 'listguests64' is configured with the setuid bit. When executed, it looks for a binary named 'virsh' using the PATH environment variable, allowing it to run 'virsh' with root privileges.
The 'lost password' functionality in b2evolution before 6.7.9 allows remote attackers to reset arbitrary user passwords via a crafted request.
In Serendipity before 2.0.5, an attacker can bypass SSRF protection by using a malformed IP address (e.g., http://127.1) or a 30x (aka Redirection) HTTP status code.
CVE-2016-3055 vulnerability in IBM FileNet Workplace 4.0.2 before version 4.0.2.14 LA012 allows remote authenticated users to read arbitrary files or cause a denial of service (memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference.
IBM AppScan Source versions 8.7 through 9.0.3.3 allows remote authenticated users to read arbitrary files or cause a denial of service (memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
IBM API Connect before version 5.0.3.0 with NPM before version 2.2.8 includes certain internal server credentials in the software package, which might allow remote attackers to bypass intended access restrictions.