CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Montgomery code in the math/big library in Go 1.5.x before version 1.5.3 mishandles carry propagation, leading to incorrect output. This makes it easier for attackers to obtain private RSA keys via unspecified vectors.
Chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key.
The Wifi hotspot in Lenovo SHAREit before version 3.2.0 for Windows has a hardcoded password of 12345678, making it easier for remote attackers to gain access when within WLAN coverage.
Lenovo SHAREit before 3.2.0 for Windows and before 3.5.48_ww for Android transfers files in cleartext, allowing remote attackers to obtain sensitive information by sniffing the network or conduct man-in-the-middle attacks.
An unspecified udev rule in the Debian fuse package in jessie before 2.9.3-15+deb8u2, in stretch before 2.9.5-1, and in sid before 2.9.5-1 sets world-writable permissions for the /dev/cuse character device. This allows local users to gain privileges via a character device in /dev, related to an ioctl.
CakePHP versions 2.x and 3.x before 3.1.5 may allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.
NTP versions 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, known as a 'skeleton key.'
Multiple unspecified vulnerabilities in HarfBuzz before 1.0.6, as used in Google Chrome before 48.0.2564.82, may allow attackers to cause a denial of service or possibly have other impact via crafted data. An example is a buffer over-read resulting from an inverted length check in hb-ot-font.cc.
Multiple unspecified vulnerabilities in Google Chrome before version 48.0.2564.82 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Multiple integer overflows in the sycc422_to_rgb and sycc444_to_rgb functions in PDFium, used in Google Chrome before version 48.0.2564.82, allow remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted PDF document.
Multiple use-after-free vulnerabilities in the formfiller implementation in PDFium, as used in Google Chrome before version 48.0.2564.82, allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document.
The LoadIC::UpdateCaches function in Google V8, used in Google Chrome before version 48.0.2564.82, does not ensure receiver compatibility before performing a cast of an unspecified variable. This allows remote attackers to cause a denial of service or possibly have unknown other impact via crafted JavaScript code.
In eCryptfs-utils, the mount.ecryptfs_private.c script does not validate filesystem types for mount points, allowing local users to gain privileges by mounting over a nonstandard filesystem.
The PV superpage functionality in Xen from versions 3.4.0 to 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impacts via a crafted page identifier (MFN).
wolfSSL versions (formerly CyaSSL) before 3.6.8 are vulnerable to a denial of service attack that can be triggered by a crafted DTLS cookie in a ClientHello message.
An unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown vectors related to Outside In Filters.
Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown vectors related to Outside In Filters.
An unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown vectors related to Outside In Filters.
CSRF vulnerability in BUFFALO BHR-4GRV2, WEX-300, WHR-1166DHP, WHR-300HP2, WHR-600D, WMR-300, WMR-433, and WSR-1166DHP devices with specific firmware versions allows remote attackers to hijack the authentication of arbitrary users.
A stack-based buffer overflow exists in Hospira Communication Engine (CE) before version 1.2, which can be exploited by remote attackers. Attackers can cause a denial of service or potentially trigger unspecified other impacts via traffic on TCP port 5000.