CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
PowerDNS (also known as pdns) versions before 3.4.10 allow remote attackers to cause a denial of service (backend CPU consumption) via a long qname.
The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive file.
Buffer overflow in the C cli shell in Apache Zookeeper before version 3.4.9 and 3.5.x before version 3.5.3, occurring when using the 'cmd:' batch mode syntax, allows attackers to have unspecified impact via a long command string.
Fortinet FortiWan before version 4.2.5 allows remote authenticated users with access to the nslookup functionality to execute arbitrary commands with root privileges via the graph parameter to diagnosis_control.php.
The archive_read_format_cpio_read_header function in libarchive before version 3.2.1 allows remote attackers to cause an application crash via a CPIO archive with a large symlink.
Heap-based buffer overflow in the parse_codes function in archive_read_support_format_rar.c in libarchive before version 3.2.1 allows remote attackers to execute arbitrary code via a RAR file with a zero-sized dictionary.
A stack-based buffer overflow in the parse_device function in archive_read_support_format_mtree.c in libarchive before version 3.2.1 allows remote attackers to execute arbitrary code via a crafted mtree file.
Integer overflow in the read_SubStreamsInfo function in archive_read_support_format_7zip.c in libarchive before version 3.2.1 allows remote attackers to execute arbitrary code via a 7zip file with a large number of substreams, leading to a heap-based buffer overflow.
HPE Performance Center before version 12.50 and LoadRunner before version 12.50 allow remote attackers to cause a denial of service via unspecified vectors.
HPE Performance Center versions 11.52, 12.00, 12.01, 12.20, and 12.50 allow remote attackers to bypass intended access restrictions via unspecified vectors, related to a 'remote user validation failure' issue.
Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before version 7.3.0-233 allow local users to obtain root access via a crafted parameter to a command that is available in the sudo configuration.
Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before version 7.3.0-233 use the same encryption key across different customers' installations, allowing remote attackers to defeat cryptographic protection mechanisms.
TLS protocol 1.2 and earlier versions support ClientCertificateType values that may allow man-in-the-middle attackers to spoof TLS servers. This issue arises from the lack of documentation regarding the computation of the master secret in certain situations, making it easier to exploit a compromised X.509 client key.
Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path.
Multiple integer overflows in the get_time_t_max and get_time_t_min functions in archive_read_support_format_mtree.c in libarchive before version 3.2.0 may allow remote attackers to trigger unspecified behavior via a crafted mtree file.
bsdtar in libarchive before version 3.2.0 allows remote attackers to cause a denial of service (infinite loop) via an ISO with a directory that is a member of itself.
The ae_strtofflags function in archive_entry.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file.
The lha_read_file_extended_header function in libarchive before version 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds heap) via a crafted lzh or lha file.
The archive_string_append function in libarchive before version 3.2.0 allows remote attackers to cause a denial of service (crash) via crafted cab files, related to 'overlapping memcpy'.
bsdtar in libarchive before version 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an invalid character in the name of a cab file.