CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Perl versions 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 improperly remove '.' characters from the end of the includes directory array. This may allow local users to gain privileges via a Trojan horse module under the current working directory.
Intel Crosswalk versions before 19.49.514.5, 20.x before 20.50.533.11, 21.x before 21.51.546.0, and 22.x before 22.51.549.0 interpret a user's acceptance of one invalid X.509 certificate as acceptance of all invalid X.509 certificates without prompting. This makes it easier for man-in-the-middle attackers to spoof SSL servers and obtain sensitive information via a crafted certificate.
Integer overflow in the kbasep_vinstr_attach_client function in Google Chrome before version 52.0.2743.85 allows remote attackers to cause a denial of service by leveraging unrestricted multiplication.
In Vtiger CRM version 6.4.0 and earlier, there is a vulnerability in Save.php that does not properly restrict user-save actions. This allows remote authenticated users to create or modify user accounts.
The TS_OBJ_print_bio function in OpenSSL up to version 1.0.2h contains a vulnerability that allows remote attackers to cause application crashes via a crafted time-stamp file. This issue occurs when processing the file with the 'openssl ts' command.
Novell Filr version 1.2 before Hot Patch 6 and 2.0 before Hot Patch 2 has world-writable permissions for the /etc/profile.d/vainit.sh file, allowing local users to gain elevated privileges by replacing this file's content with arbitrary shell commands.
Directory traversal vulnerability in the email-template feature in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote attackers to bypass intended access restrictions and write to arbitrary files via a .. (dot dot) in a blob name.
In Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2, remote authenticated users can execute arbitrary commands via shell metacharacters in the ntpServer parameter.
Multiple CSRF vulnerabilities in the administrative interface in Novell Filr before 2.0 Security Update 2 allow remote attackers to hijack the authentication of administrators, as demonstrated by reconfiguring time settings via a vaconfig/time request.
A vulnerability in Cisco AsyncOS on Email Security Appliance (ESA) devices allows remote attackers to bypass malware detection via a crafted attachment in an email message.
Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authentication of administrators for various requests, such as adding new repositories or editing existing ones.
Rockwell Automation FactoryTalk EnergyMetrix versions before 2.20.00 do not invalidate credentials upon a logout action, making it easier for remote attackers to gain access by leveraging an unattended workstation.
Cisco FireSIGHT System Software versions 5.3.0, 5.3.1, 5.4.0, 6.0, and 6.0.1 allows remote attackers to bypass Snort rules via crafted parameters in the header of an HTTP packet.
The web framework in Cisco Unified Computing System (UCS) Performance Manager 2.0.0 and earlier allows remote authenticated users to execute arbitrary commands via crafted parameters in a GET request.
The RSA-CRT implementation in the Cavium Software Development Kit (SDK) 2.x on OCTEON II CN6xxx hardware on Linux, supporting TLS with Perfect Forward Secrecy (PFS), is vulnerable to a Lenstra side-channel attack, making it easier for remote attackers to obtain private RSA keys.
CA eHealth versions 6.2.x and 6.3.x before 6.3.2.13 allows remote authenticated users to cause a denial of service or possibly execute arbitrary commands via unspecified vectors.
CA eHealth 6.2.x allows remote authenticated users to cause a denial of service or possibly execute arbitrary commands via unspecified vectors.
Integer overflow in the php_stream_zip_opener function in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted zip:// URL.
Integer overflow in the virtual_file_ex function in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted extract operation on a ZIP archive.
Use-after-free vulnerability in user_script_injector.cc in the Extensions subsystem in Google Chrome before version 52.0.2743.82 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to script deletion.