CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
IBM Multi-Enterprise Integration Gateway versions 1.0 through 1.0.0.1 and B2B Advanced Communications versions 1.0.0.2 through 1.0.0.4 do not require HTTPS. This may allow remote attackers to obtain sensitive information by sniffing the network.
Google Chrome before version 50.0.2661.102 on Android mishandles / (slash) and \ (backslash) characters, allowing attackers to conduct directory traversal attacks via a file: URL.
The Zone::New function in Google V8 before version 5.0.71.47 and in Google Chrome before version 50.0.2661.102 does not properly determine when to expand certain memory allocations. This can lead to denial of service (buffer overflow) or other unspecified impacts via crafted JavaScript code.
The forEachForBinding function in V8 bindings in Blink, used in Google Chrome before version 50.0.2661.102, uses an improper creation context, allowing remote attackers to bypass the Same Origin Policy via a crafted website.
The TreeScope::adoptIfNeeded function in the DOM implementation in Blink, used in Google Chrome before version 50.0.2661.102, does not prevent script execution during node-adoption operations. This allows remote attackers to bypass the Same Origin Policy via a crafted web site.
The SerializedScriptValue::transferArrayBuffers function in WebKit in Blink, used in Google Chrome before version 50.0.2661.94, mishandles certain array-buffer data structures. This can lead to denial of service (use-after-free) or other unspecified impacts via a crafted website.
Blink in Google Chrome before version 50.0.2661.94 does not ensure that frames satisfy an additional check for the same renderer process, which can lead to denial of service (memory corruption) or other unspecified impacts via a crafted website.
Blink, as used in Google Chrome before version 50.0.2661.94, mishandles assertions in the WTF::BitArray and WTF::double_conversion::Vector classes. This allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted web site.
HPE System Management Homepage before version 7.5.5 allows local users to obtain sensitive information or modify data via unspecified vectors.
The server in Apple FileMaker before version 14.0.4 on OS X allows remote attackers to read PHP source code via unspecified vectors.
The packet-processing microcode in Cisco IOS 15.2(2)EA, 15.2(2)EA1, 15.2(2)EA2, and 15.2(4)EA on Industrial Ethernet 4000 devices and 15.2(2)EB and 15.2(2)EB1 on Industrial Ethernet 5000 devices allows remote attackers to cause a denial of service (packet data corruption) via crafted IPv4 ICMP packets.
CVE-2015-8156 describes an unquoted Windows search path vulnerability in the EEDService in Symantec Endpoint Encryption (SEE) 11.x before version 11.1.1. This allows local users to gain privileges via a Trojan horse executable file in the %SYSTEMDRIVE% directory.
The GIF loader in imlib2 before version 1.4.9 allows remote attackers to cause a denial of service (application crash) or obtain sensitive information via a crafted image, which triggers an out-of-bounds read.
Off-by-one error in the __imlib_MergeUpdate function in lib/updates.c in imlib2 before version 1.4.9 allows remote attackers to cause a denial of service via crafted coordinates.
Off-by-one error in afs_pioctl.c in OpenAFS before 1.6.16 might allow local users to cause a denial of service (memory overwrite and system crash) via a pioctl with an input buffer size of 4096 bytes.
Integer overflow in imlib2 before version 1.4.7 allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted image, leading to an invalid read operation.
Imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a crafted GIF file.
Imlib2 before 1.4.7 allows remote attackers to cause a denial of service via a crafted PNM file, leading to a divide-by-zero error and application crash.
Imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a GIF image without a colormap.
Imlib2 before 1.4.9 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) by drawing a 2x1 ellipse.