CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in tibemsd in the server in TIBCO Enterprise Message Service (EMS) before version 8.3.0 and EMS Appliance before version 2.4.0 allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via crafted inbound data.
In 389 Directory Server (formerly Fedora Directory Server) versions 1.3.4.x before 1.3.4.7, a vulnerability allows remote attackers to cause a denial of service through an abnormally closed connection, leading to an infinite loop and connection blocking.
Buffer overflow in the main_get_appheader function in xdelta3-main.h in xdelta3 before 3.0.9 allows remote attackers to execute arbitrary code via a crafted input file.
SQL injection vulnerability in the Workflow Screen in dotCMS before version 3.3.2 allows remote administrators to execute arbitrary SQL commands via the orderby parameter.
Integer overflow in the x86 shadow pagetable code in Xen allows local guest OS users to cause a denial of service (host crash) or possibly gain privileges by shadowing a superpage mapping.
Panda Endpoint Administration Agent before version 7.50.00 uses a weak ACL for the Panda Security/WaAgent directory and sub-directories, allowing local users to gain SYSTEM privileges by modifying an executable module.
Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the 'Panda Security URL Filtering' directory and installed files, allowing local users to gain SYSTEM privileges by modifying Panda_URL_Filteringb.exe.
Libreswan version 3.16 may allow remote attackers to cause a denial of service (daemon restart) via an IKEv2 aes_xcbc transform.
CVE-2015-8106 is a format string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before version 2.3.10, allowing remote attackers to execute arbitrary code via format string specifiers in the \keywords command in a crafted TeX file.
Heap-based buffer overflow in the gdk_pixbuf_flip function in gdk-pixbuf-scale.c in gdk-pixbuf 2.30.x allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted BMP file.
The download implementation in Google Chrome before version 50.0.2661.75 on Android allows remote attackers to bypass intended pathname restrictions via unspecified vectors.
Google Chrome before 50.0.2661.75 does not properly consider that frame removal may occur during callback execution, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted extension.
The LoadBuffer implementation in Google V8, used in Google Chrome before version 50.0.2661.75, mishandles data types, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers an out-of-bounds write operation.
In PDFium, used in Google Chrome before version 50.0.2661.75, the sycc420_to_rgb and sycc422_to_rgb functions are not properly implemented, allowing remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via crafted JPEG 2000 data in a PDF document.
In Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before April 1, 2016, Wi-Fi does not prevent the use of a CA certificate in an unrelated CA role. This allows attackers to gain privileges via a crafted application.
In Android 4.x before 4.4.4, the rootdir/init.rc file does not ensure that the /data/tombstones directory exists for the Debuggerd component. This allows attackers to gain privileges via a crafted application.
The IOMX.cpp file in mediaserver in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before April 1, 2016, does not initialize a handle pointer, allowing attackers to gain privileges via a crafted application.
The SkPostConfig.h file in Skia, used in System_server on Android, mishandles certain crashes. This allows attackers to gain privileges via a crafted application.
A Qualcomm video kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application that leverages control over a service that can call this driver.
A Texas Instruments haptic kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application that leverages control over a service that can call this driver.