CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Fiddle::Handle implementation in Ruby before version 2.0.0-p648, 2.1 before 2.1.8, and 2.2 before 2.2.4, has a flaw in taint handling, allowing attackers to execute arbitrary code or cause application crashes via a crafted string.
The vulnerability in ABB Panel Builder 800 5.1 related to an untrusted search path allows local users to gain privileges via a Trojan horse DLL in the current working directory.
The SysPlant.sys driver in the Application and Device Control (ADC) component in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6-MP4 allows remote attackers to execute arbitrary code via a crafted HTML document, related to 'RWX Permissions.'
CVE-2015-8153 is an SQL injection vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6-MP4 that allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVE-2015-8152 is a CSRF vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6-MP4 that allows remote authenticated users to hijack the authentication of administrators for requests that execute arbitrary code by adding lines to a logging script.
IBM Tivoli NetView Access Services (NVAS) allows remote authenticated users to gain privileges by entering the ADM command and modifying a 'page ID' field to the EMSPG2 transaction code.
HPE System Management Homepage before 7.5.4 allows local users to obtain sensitive information or modify data via unspecified vectors.
HPE System Management Homepage before version 7.5.4 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.
The bgp_nlri_parse_vpnv4 function in bgpd in Quagga before version 1.0.20160309 is vulnerable to stack-based buffer overflow when a certain VPNv4 configuration is used. Remote attackers can exploit this vulnerability to execute arbitrary code or cause a denial of service.
HPE ArcSight ESM versions 5.x before 5.6, 6.0, 6.5.x before 6.5C SP1 Patch 2, 6.8c before P1, and ArcSight ESM Express before 6.9.1, allows remote authenticated users to conduct unspecified 'file download' attacks via unknown vectors.
HPE ArcSight ESM versions 5.x before 5.6, 6.0, 6.5.x before 6.5C SP1 Patch 2, 6.8c before P1, and ArcSight ESM Express before 6.9.1, allows local users to gain privileges for command execution via unspecified vectors.
In glibc versions before 2.19-18+deb8u4 on Debian jessie and before 2.15-0ubuntu10.14 on Ubuntu 12.04 LTS, 2.19-0ubuntu6.8 on Ubuntu 14.04 LTS, 2.21-0ubuntu4.2 on Ubuntu 15.10, and 2.23-0ubuntu1 on Ubuntu 16.04 LTS and 16.10, there is a lack of namespace check associated with file-descriptor passing. This allows local users to capture keystrokes and spoof data, potentially gaining privileges.
Multiple integer signedness errors in the opj_j2k_update_image_data function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before version 49.0.2623.87, may allow remote attackers to cause a denial of service or potentially have unspecified other impact via crafted JPEG 2000 data.
In WebKit/Source/core/layout/LayoutObject.cpp in Blink, used in Google Chrome before version 49.0.2623.87, relayout scheduling is improperly restricted, allowing remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted HTML document.
The ImageInputType::ensurePrimaryContent function in Blink, as used in Google Chrome before version 49.0.2623.87, does not properly maintain the user agent shadow DOM, which may lead to denial of service or other unspecified impacts.
The graphite2::TtfUtil::CmapSubtable4NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
The graphite2::TtfUtil::CmapSubtable12Lookup function in Graphite 2 before 1.3.6, used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
The graphite2::Slot::getAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
Heap-based buffer overflow in the graphite2::Slot::setAttr function in Graphite 2 before 1.3.6 allows remote attackers to exploit this vulnerability. This affects Mozilla Firefox before version 45.0 and Firefox ESR 38.x before version 38.7.
The graphite2::GlyphCache::Loader::Loader function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.