CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
On Samsung Galaxy S4 through S7 devices, the 'omacp' app ignores security information embedded in the OMACP messages, leading to the acceptance, parsing, and handling of unsolicited WAP Push SMS messages by the device.
On Samsung Galaxy S4 through S7 devices, a malformed OTA WAP PUSH SMS containing an OMACP message triggers an unhandled ArrayIndexOutOfBoundsException in Samsung's implementation of the WifiServiceImpl class. This causes the Android runtime to continually crash, rendering the device unusable until a factory reset is performed.
On Samsung Galaxy S4 through S7 devices, absence of permissions on the BroadcastReceiver responsible for handling the com.[Samsung].android.intent.action.SET_WIFI intent leads to unsolicited configuration messages being handled by wifi-service.jar within the Android Framework.
The sendRequest method in the HTTPClient Class in file /inc/HTTPClient.php in DokuWiki 2016-06-26a and older, when media file fetching is enabled, has no way to restrict access to private networks. This allows users to scan ports of internal networks via SSRF.
There is a NULL Pointer Access in function imagetopnm of convert.c in OpenJPEG 2.1.2. The value of image->comps[compno].data is not assigned after initialization, leading to a program crash.
There is a NULL pointer dereference in function imagetobmp of convertbmp.c:980 of OpenJPEG 2.1.2. The image->comps[0].data is not assigned a value after initialization (NULL), leading to Denial of Service.
A floating point exception (FPE) occurs in the opj_pi_next_cprl function in OpenJPEG 2.1.2, which may lead to calculation errors, including division by zero.
An out-of-bounds read vulnerability was observed in the Sp_replace_regexp function of Artifex Software, Inc. MuJS before version 5000749f5afe3b956fc916e407309de840997f4a. Successful exploitation of this issue can lead to code execution or denial of service condition.
HPE System Management Homepage before v7.6 allows remote attackers to have an unspecified impact via unknown vectors, related to a 'Buffer Overflow' issue.
HPE System Management Homepage before v7.6 allows remote attackers to have an unspecified impact via unknown vectors, related to a 'Buffer Overflow' issue.
A stack based buffer overflow vulnerability exists in the ipNameAdd functionality of Iceni Argus version 6.6.04 for Linux x64 and Windows x64. A specially crafted PDF file can cause a buffer overflow resulting in arbitrary code execution.
In version 6.6.04 of Iceni Argus, there is a stack-based buffer overflow vulnerability in the ipfSetColourStroke function. A specially crafted PDF file can cause a buffer overflow, leading to arbitrary code execution.
In version 4.0.6 of the LibTIFF library, there is a remote code execution vulnerability related to the handling of TIFF images. A crafted TIFF document can lead to a type confusion vulnerability resulting in remote code execution.
An unauthorized redirect vulnerability in Citrix NetScaler ADC before version 10.1 135.8, 10.5 61.11, 11.0 65.31/65.35F, and 11.1 47.14 allows a remote attacker to steal session cookies of a legitimate AAA user via manipulation of the Host header.
MuJS before version a5c747f1d40e8d6659a37a8d25f13fb5acf8e767 allows context-dependent attackers to obtain sensitive information by using the 'opname in crafted JavaScript file' approach. The issue is related to an 'Out-of-Bounds read' in the jsC_dumpfunction function in the jsdump.c component.
Docker Engine version 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes.
In dotCMS version 3.2.1, an attacker can load captcha once, fill it with the correct value, and then this correct value will be accepted for forms with captcha check later.
Moodle version 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a 'SQL Injection' issue affecting the Administration panel function in the installation process.
A buffer overflow in OpenJPEG 2.1.1 can lead to arbitrary code execution when parsing a crafted image. Exploiting this vulnerability requires the user to open a malicious jpeg2000 file.
A vulnerability in email message and content filtering in Cisco AsyncOS for Cisco Email Security Appliances (ESA) and Web Security Appliances (WSA) allows an unauthenticated, remote attacker to bypass filtering functionality. Emails that should have been quarantined could instead be processed.