CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Lenovo SHAREit before 3.5.98_ww on Android before 4.2 allows remote attackers to conduct an attack via a crafted intent scheme URL.
A buffer overflow in the Smart DNS functionality in Huawei NGFW and Secospace USG6300, USG6500, USG6600, and USG9500 firewalls allows remote attackers to cause a denial of service or execute arbitrary code via a crafted packet.
Huawei S12700 switches with software before V200R008C00SPC500 and S5700 switches with software before V200R005SPH010, when the debug switch is enabled, allow remote attackers to cause a denial of service or execute arbitrary code via crafted DNS packets.
The bgp_dump_routes_func function in Quagga does not perform size checks when dumping data, which might allow remote attackers to cause a denial of service (assertion failure and daemon crash) via a large BGP packet.
Buffer overflow in the stellaris_enet_receive function in QEMU can lead to system crashes when the Stellaris ethernet controller is configured to accept large packets.
The Verify function in the crypto/dsa/dsa.go library in Go before version 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big integer library. This may allow remote attackers to cause a denial of service (infinite loop) via a crafted public key to a program using HTTPS client certificates or SSH server libraries.
On Windows, in Go versions before 1.5.4 and 1.6.x before 1.6.1, there is an untrusted search path vulnerability. This allows local users to gain privileges via a Trojan horse DLL in the current working directory.
Trend Micro Mobile Security for iOS before version 3.2.1188 does not verify the X.509 certificate of the mobile application login server, allowing man-in-the-middle attackers to spoof this server and obtain sensitive information via a crafted certificate.
The Huawei Mobile Broadband HL Service 22.001.25.00.03 and earlier uses a weak ACL for the MobileBrServ program data directory, allowing local users to gain SYSTEM privileges by modifying VERSION.dll.
The tipc_nl_publ_dump function in the Linux kernel through version 4.6 does not verify socket existence, allowing local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a dumpit operation.
Podatność w jądrze Linux przed wersją 4.5.5 w funkcji get_rock_ridge_filename w pliku fs/isofs/rock.c nieprawidłowo obsługuje wpisy NM (alternatywne nazwy) zawierające znaki \0. Umożliwia to lokalnym użytkownikom odczyt wrażliwych informacji z pamięci jądra lub potencjalnie inne skutki poprzez spreparowany system plików isofs.
A use-after-free vulnerability in ppp_generic.c in the Linux kernel before version 4.5.2 allows local users to cause a denial of service by removing a network namespace, potentially leading to memory corruption and system crashes.
Use-after-free vulnerability in mm/percpu.c in the Linux kernel through 4.6 allows local users to cause a denial of service (BUG) or possibly have unspecified other impact via crafted use of the mmap and bpf system calls.
The x25_negotiate_facilities function in the Linux kernel before version 4.5.5 does not properly initialize a certain data structure, allowing attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request.
In the Linux kernel before version 4.5.3, a vulnerability allows local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a crafted number of planes in a VIDIOC_DQBUF ioctl call.
The InfiniBand stack in the Linux kernel before version 4.5.3 incorrectly relies on the write system call, allowing local users to cause a denial of service or possibly have unspecified other impact via a uAPI interface.
The BPF subsystem in the Linux kernel before version 4.5.5 mishandles reference counts, allowing local users to cause a denial of service (use-after-free) or possibly other unspecified impacts via a crafted application on a system with more than 32 Gb of memory or a 1 Tb system.
The replace_map_fd_with_map_ptr function in the Linux kernel before version 4.5.5 does not properly maintain an fd data structure, allowing local users to gain privileges or cause a denial of service (use-after-free) via crafted BPF instructions referencing an incorrect file descriptor.
The llc_cmsg_rcv function in the Linux kernel before version 4.5.5 does not initialize a certain data structure, allowing attackers to obtain sensitive information from kernel stack memory by reading a message.
CVE-2016-2157 describes a CSRF vulnerability in mod/assign/adminmanageplugins.php in Moodle that allows remote attackers to hijack the authentication of administrators for managing Assignment plugins.