CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a rebuild of the user profile form.
Junos OS versions before 12.1X46-D45, 12.1X46-D50, 12.1X47 before 12.1X47-D35, 12.3X48 before 12.3X48-D30, 13.3 before 13.3R9-S1, 14.1 before 14.1R7, 14.2 before 14.2R6, 15.1 before 15.1F2-S5, 15.1F4 before 15.1F4-S2, 15.1R before 15.1R2-S3, 15.1 before 15.1R3, and 15.1X49 before 15.1X49-D40 allow remote attackers to cause a denial of service (kernel crash) via a crafted UDP packet destined to the interface IP address of a 64-bit OS device.
The stringprep_utf8_nfkc_normalize function in libidn before version 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted UTF-8 data.
In libidn before version 1.33, a vulnerability may allow remote attackers to obtain sensitive memory information by reading a zero byte as input, triggering an out-of-bounds read.
The idna_to_ascii_4i function in lib/idna.c in libidn before version 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via 64 bytes of input.
The WiFi driver in Huawei Honor 6 smartphones with specific software versions allows attackers to cause a system crash or gain privileges via a crafted application.
In GNU libidn before version 1.33, a vulnerability exists that may allow remote attackers to obtain sensitive memory information by reading a zero byte as input, triggering an out-of-bounds read.
Huawei Unified Maintenance Audit (UMA) before version V200R001C00SPC200 SPH206 allows remote attackers to reset arbitrary user passwords, potentially affecting system data integrity.
The Intelligent Baseboard Management Controller (iBMC) in Huawei RH1288 V3, RH2288 V3, RH2288H V3, RH5885 V3, and XH620, XH622, and XH628 servers with software before V100R003C00SPC610 may allow remote attackers to decrypt encrypted data, leading to the exposure of sensitive information.
The RESOLV::lookup iRule command in F5 BIG-IP LTM, APM, ASM, and Link Controller in versions 10.2.1 through 10.2.4, 11.2.1, 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1, and 12.0.0 before HF3 is vulnerable to an attack that can lead to denial of service via a crafted PTR response from remote DNS servers.
Huawei X6800, XH620 V3, RH1288 V3, RH2288 V3, CH140 V3, CH226 V3, CH220 V3, CH121 V3, and CH222 V3 servers with software before V100R003C00SPC606 (and others listed) may allow remote attackers to decrypt encrypted data, leading to the exposure of sensitive information.
A stack-based buffer overflow in the FascistGecosUser function in the cracklib library allows local users to cause a denial of service (application crash) or gain privileges via a long GECOS field.
Ruby on Rails 4.2.x versions before 4.2.7.1 improperly handle parameter differences between the Active Record component and the JSON implementation, allowing remote attackers to bypass intended database-query restrictions.
The Camera driver in Huawei Honor 4C smartphones with software before version CHM-UL00C00B564, CHM-TL00C01 before CHM-TL00C01B564, and CHM-TL00C00 before CHM-TL00HC00B564 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application.
The Camera driver in Huawei Honor 4C smartphones with software before versions CHM-UL00C00B564, CHM-TL00C01B564, and CHM-TL00HC00B564 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application.
The Camera driver in Huawei Honor 4C smartphones with software before versions CHM-UL00C00B564, CHM-TL00C01B564, and CHM-TL00HC00B564 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application.
The Camera driver in Huawei Honor 4C smartphones with specific software versions allows attackers to cause a system crash or gain privileges via a crafted application.
The Camera driver in Huawei Honor 4C smartphones with software before versions CHM-UL00C00B564, CHM-TL00C01B564, and CHM-TL00HC00B564 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application.
The web console in Red Hat JBoss Operations Network (JON) before version 3.3.7 does not properly authorize requests to add users with the super user role, allowing remote authenticated users to gain admin privileges via a crafted POST request.
The dashbuilder in Red Hat JBoss BPM Suite 6.3.2 does not properly handle CSRF tokens generated during an active session, allowing remote attackers to bypass CSRF protection mechanisms or conduct CSRF attacks by obtaining an old token.