CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In Redmine before version 2.6.7, 3.0.x before 3.0.5, and 3.1.x before 3.1.1, there is an open redirect vulnerability in the valid_back_url function. This allows remote attackers to redirect users to arbitrary websites, potentially leading to phishing attacks.
Avast allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via a crafted PE file, related to authenticode parsing.
The net_checksum_calculate function in QEMU allows local guest OS users to cause a denial of service through out-of-bounds heap read and crash by exploiting the payload length in a crafted packet.
CVE-2016-1568 is a use-after-free vulnerability in hw/ide/ahci.c in QEMU when built with IDE AHCI Emulation support. It allows guest OS users to cause an instance crash or potentially execute arbitrary code via an invalid AHCI Native Command Queuing (NCQ) AIO command.
Stack-based buffer overflow in the conv_euctojis function in Claws Mail 3.13.1 allows remote attackers to have unspecified impact via a crafted email, involving Japanese character set conversion.
Multiple stack-based buffer overflows in the conv_jistoeuc, conv_euctojis, and conv_sjistoeuc functions in Claws Mail before version 3.13.1 may allow remote attackers to have unspecified impact via a crafted email, involving Japanese character set conversion.
The host_new_graphs function in graphs_new.php in Cacti 0.8.8f and earlier has an SQL injection vulnerability that allows remote authenticated users to execute arbitrary SQL commands via the cg_g parameter in a save action.
Puppet Enterprise 2015.3 before 2015.3.1 allows remote attackers to bypass a host whitelist protection mechanism by leveraging the Puppet communications protocol.
The CSV export in Apache LDAP Studio and Apache Directory Studio before version 2.0.0-M10 does not properly escape field values, which might allow attackers to execute arbitrary commands by leveraging a crafted LDAP entry that is interpreted as a formula when imported into a spreadsheet.
The TripleO Heat templates in Red Hat Enterprise Linux OpenStack Platform 7.0 do not properly use the configured RabbitMQ credentials, making it easier for remote attackers to gain access to services in deployed overclouds by leveraging knowledge of the default credentials.
The TripleO Heat templates (tripleo-heat-templates) allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter.
Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy.
The Policy Admin Tool in Apache Ranger before version 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs.
Huawei Quidway S9700, S5700, S5300, S9300, and S7700 switches with software before V200R003SPH012 are vulnerable to remote attacks that can cause a denial of service by forcing a switch restart via crafted traffic.
CVE-2016-3675 is an SQL injection vulnerability in Huawei Policy Center with software versions before V100R003C10SPC020. It allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to system databases.
SQL injection vulnerability in graph_view.php in Cacti 0.8.8.g allows remote authenticated users to execute arbitrary SQL commands via the host_group_data parameter.
PostgreSQL before 9.5.x before 9.5.2 does not properly maintain row-security status in cached plans, which might allow attackers to bypass intended access restrictions.
The oarsh script in OAR before version 2.5.7 allows remote authenticated users of a cluster to obtain sensitive information and possibly gain privileges via vectors related to OpenSSH options.
The decode_search function in dhcp.c in dhcpcd 3.x does not properly free allocated memory, allowing remote DHCP servers to cause a denial of service via a crafted response.
The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds read) via a crafted response.