CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The is-my-json-valid package before 2.12.4 for Node.js has an incorrect exports['utc-millisec'] regular expression, which allows remote attackers to cause a denial of service (blocked event loop) via a crafted string.
Multiple use-after-free vulnerabilities in SAP 3D Visual Enterprise Viewer allow remote attackers to execute arbitrary code via a crafted SketchUp document.
Multiple cross-site request forgery (CSRF) vulnerabilities in the lesson module in Moodle allow remote attackers to hijack the authentication of arbitrary users for specific requests.
In Moodle through version 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2, the random_string and complex_random_string functions rely on the PHP mt_rand function, making it easier for remote attackers to predict password-recovery tokens via a brute-force approach.
The clean_param function in lib/moodlelib.php in Moodle has an open redirect vulnerability that allows remote attackers to redirect users to arbitrary websites.
In phpMyAdmin versions 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4, there is a vulnerability related to the comparison of CSRF tokens that does not use a constant-time algorithm. This allows remote attackers to bypass intended access restrictions by measuring time differences.
The suggestPassword function in phpMyAdmin before version 4.0.10.13, 4.4.15.3, and 4.5.4 relies on the Math.random JavaScript function, making it easier for remote attackers to guess passwords via a brute-force approach.
The SSH implementation in Cisco StarOS before version 19.3.M0.62771 and 20.x before version 20.0.M0.62768 on ASR 5000 devices mishandles a multi-user public-key authentication configuration, allowing remote authenticated users to gain privileges by establishing a connection from an endpoint previously used for an administrator's connection.
Microsoft Internet Explorer versions 9 through 11 allow remote attackers to bypass the Same Origin Policy via unspecified vectors, leading to elevation of privilege.
Microsoft Internet Explorer versions 9 through 11 allow remote attackers to bypass the Same Origin Policy via unspecified vectors, leading to elevation of privilege.
Symantec Encryption Management Server (SEMS) version 3.3.2 before MP12 allows local users to obtain root access by modifying a batch file.
The LDAP service in Symantec Encryption Management Server (SEMS) version 3.3.2 before MP12 is vulnerable to remote attacks that can lead to service outages due to heap memory corruption.
The LDAP service in Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote attackers to obtain sensitive information about administrator accounts via a modified request.
LibreOffice versions before 5.0.5 allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LwpTocSuperLayout record in a LotusWordPro (lwp) document.
The lwp filter in LibreOffice before 5.0.4 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LotusWordPro (lwp) document.
Multiple stack-based buffer overflows in the libresolv library in GNU C Library (glibc) before version 2.23 exist in the send_dg and send_vc functions. Remote attackers can cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response.
PostgreSQL versions before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 are vulnerable to remote attacks that can lead to denial of service via an infinite loop or buffer overflow.
PostgreSQL versions before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 do not properly restrict access to unspecified custom configuration settings (GUCS) for PL/Java, allowing attackers to gain privileges via unspecified vectors.
Multiple cross-site request forgery (CSRF) vulnerabilities in Cybozu Office versions 9.9.0 through 10.3.0 allow remote attackers to hijack the authentication of arbitrary users.
CVE-2015-8483 in Cybozu Office versions 10.2.0 to 10.3.0 has an open redirect vulnerability that allows remote attackers to redirect users to arbitrary websites.