CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Citrix Studio before 7.6.1000, Citrix XenDesktop 7.x before 7.6 LTSR Cumulative Update 1, and Citrix XenApp 7.5 and 7.6 allow attackers to set Access Policy rules on the XenDesktop Delivery Controller via unspecified vectors.
The attemptAuthentication function in Symfony before versions 2.3.41, 2.7.13, 2.8.6, and 3.0.6 does not limit the length of a username stored in a session. This allows remote attackers to cause a denial of service through a series of authentication attempts with long, non-existent usernames.
The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library, and the openssl_random_pseudo_bytes function fails.
Multiple integer overflows in the pixops_composite_nearest, pixops_composite_color_nearest, and pixops_process functions in gdk-pixbuf before version 2.33.1 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted image.
In libcontainer/user/user.go in runC before version 0.1.0, used in Docker before version 1.11.2, a numeric UID is improperly treated as a potential username. This allows local users to gain privileges via a numeric username in the password file in a container.
A stack-based buffer overflow exists in the nss_dns implementation of the getnetbyname function in GNU C Library (glibc) before version 2.24. Attackers can exploit this vulnerability by providing a long name, leading to application crashes.
Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, allowing context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.
A stack-based buffer overflow in the glob implementation in GNU C Library (glibc) before version 2.24 can be exploited by context-dependent attackers. This allows them to cause a denial of service (crash) by providing a long name.
CSRF vulnerability in Resource Data Management (RDM) Intuitive 650 TDB Controller devices before version 2.1.24 allows remote authenticated users to hijack the authentication of arbitrary users.
Intuitive 650 RDM TDB Controller devices before version 2.1.24 allow remote authenticated users to modify arbitrary passwords via unspecified vectors.
Environmental Systems Corporation (ESC) 8832 Data Controller version 3.02 and earlier allows remote attackers to bypass intended access restrictions and execute arbitrary functions via a modified parameter.
Moxa MiiNePort_E1_4641, MiiNePort_E1_7080, MiiNePort_E2_1242, MiiNePort_E2_4561, and MiiNePort E3 devices with specified firmware versions allow remote attackers to obtain sensitive cleartext information by reading a configuration file.
Moxa MiiNePort_E1_4641, MiiNePort_E1_7080, MiiNePort_E2_1242, MiiNePort_E2_4561, and MiiNePort E3 devices with specified firmware versions have a blank default password. This allows remote attackers to gain access via unspecified vectors.
There is a cross-site request forgery (CSRF) vulnerability in Moxa MiiNePort_E1_4641, MiiNePort_E1_7080, MiiNePort_E2_1242, MiiNePort_E2_4561, and MiiNePort E3 devices. This allows remote attackers to hijack the authentication of arbitrary users.
Moxa Secure Router EDR-G903 devices before version 3.4.12 do not delete copies of configuration and log files after completing the import function, allowing remote attackers to obtain sensitive information by requesting these files at an unspecified URL.
Moxa Secure Router EDR-G903 devices before version 3.4.12 are vulnerable to a denial of service (cold start) attack by sending two crafted ping requests.
A memory leak on Moxa Secure Router EDR-G903 devices before version 3.4.12 allows remote attackers to cause a denial of service by executing the ping function.
Moxa Secure Router EDR-G903 devices before version 3.4.12 allow remote attackers to discover cleartext passwords by reading a configuration file.
Moxa Secure Router EDR-G903 devices before version 3.4.12 allow remote attackers to read configuration and log files via a crafted URL.
CVE-2016-4118 describes an untrusted search path vulnerability in the installer of Adobe Connect Add-In before version 11.9.976.291 on Windows, allowing local users to gain privileges via unspecified vectors.