CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The sws_init_context function in libswscale/utils.c in FFmpeg before version 2.7.2 does not initialize certain pixbuf data structures, allowing remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted video data.
The allocate_buffers function in libavcodec/alac.c in FFmpeg before version 2.7.2 does not initialize certain context data, allowing remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted Apple Lossless Audio Codec (ALAC) data.
The destroy_buffers function in libavcodec/sanm.c in FFmpeg before version 2.7.2 does not properly maintain height and width values in the video context, allowing remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via crafted LucasArts Smush video data.
The ff_mpv_common_init function in libavcodec/mpegvideo.c in FFmpeg before 2.7.2 does not properly maintain the encoding context, allowing remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted MPEG data.
The ff_sbr_apply function in libavcodec/aacsbr.c in FFmpeg before version 2.7.2 does not check for a matching AAC frame syntax element before proceeding with Spectral Band Replication calculations. This allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted AAC data.
Multiple integer underflows in the ff_mjpeg_decode_frame function in libavcodec/mjpegdec.c in FFmpeg before version 2.7.2 allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted MJPEG data.
The decode_ihdr_chunk function in libavcodec/pngdec.c in FFmpeg before version 2.7.2 does not enforce uniqueness of the IHDR (image header) chunk in a PNG image, allowing remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted image with two or more of these chunks.
In ISC BIND versions 9.9.7 before 9.9.7-P3 and 9.10.x before 9.10.2-P4, a vulnerability allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a crafted DNS response.
In ISC BIND 9.x before version 9.9.7-P3 and 9.10.x before version 9.10.2-P4, a vulnerability allows remote attackers to cause a denial of service (assertion failure and daemon exit) by creating a zone containing a malformed DNSSEC key and issuing a query for a name in that zone.
In versions prior to 4.0.12.1 of Invision Power Services IPS Community Suite, remote attackers can cause a denial of service through a crafted URL, leading to loops and memory consumption.
A SQL injection vulnerability in the Sophos Cyberoam CR500iNG-XP firewall appliance with CyberoamOS 10.6.2 MR-1 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter to login.xml.
WebUpgrade in Netsweeper before version 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and create a system backup tarball, restart the server, or stop the filters on the server via a ' (single quote) character in the login and password parameters.
The JavaServer Pages (JSP) component in Cisco Integrated Management Controller (IMC) Supervisor before version 1.0.0.1 and UCS Director before version 5.2.0.1 allows remote attackers to write to arbitrary files via crafted HTTP requests.
EMC Documentum Content Server before 7.1P20 and 7.2.x before 7.2P04 does not properly verify authorization for dm_job object access, allowing remote authenticated users to obtain superuser privileges via crafted object operations.
The XML parser in EMC Atmos before version 2.2.3.426 and 2.3.x before 2.3.1.0 allows remote authenticated users to read arbitrary files or cause a denial of service (CPU and memory consumption) via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
A double free vulnerability in the opj_j2k_copy_default_tcp_and_create_tcd function in j2k.c in OpenJPEG before r3002, as used in PDFium in Google Chrome before version 45.0.2454.85, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by triggering a memory-allocation failure.
Multiple unspecified vulnerabilities in Google V8 before version 4.5.103.29, as used in Google Chrome before version 45.0.2454.85, may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Multiple unspecified vulnerabilities in Google Chrome before version 45.0.2454.85 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
A use-after-free vulnerability in the shared-timer implementation in Blink, as used in Google Chrome before version 45.0.2454.85, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging erroneous timer firing.
The WebRequest API implementation in Google Chrome before version 45.0.2454.85 does not properly consider a request's source before accepting the request, allowing remote attackers to bypass intended access restrictions via a crafted app or extension.