CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in an ActiveX control in Atx45.ocx in Schneider Electric ProClima before version 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors.
Vulnerability in apinit on Cray devices with CLE before version 4.2.UP02 and 5.x before version 5.1.UP00, which does not use alpsauth data to validate the UID in a launch message. This allows local users to gain privileges via a modified aprun program.
Multiple stack-based buffer overflows in VideoLAN VLC media player before version 1.0.2 allow remote attackers to execute arbitrary code via crafted ASF, AVI, or MP4 files.
An integer underflow in the real_get_rdt_chunk function in real.c used in VideoLAN VLC media player before 1.0.1 and in MPlayer before r29447 allows remote attackers to execute arbitrary code via a crafted length value in an RDT chunk header.
A heap-based buffer overflow in VideoLAN VLC media player before version 1.0.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted byte stream in an RTMP session.
The ZIP archive decompressor in VideoLAN VLC media player before version 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly execute arbitrary code via a crafted archive.
VideoLAN VLC media player before version 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly execute arbitrary code via a crafted byte stream to the (1) AVI, (2) ASF, or (3) Matroska (aka MKV) demuxer.
Multiple heap-based buffer overflows in VideoLAN VLC media player before version 1.0.6 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted byte stream to the A/52, DTS, or MPEG Audio decoder.
In WebKit in Google Chrome before version 11.0.696.65, there is a bug in RenderSVGText.cpp that improperly casts a variable when handling a block child. This can lead to application crashes or other unknown impacts via a crafted text element in an SVG document.
A use-after-free vulnerability in the FrameView::calculateScrollbarModesForLayout function in WebKit in Google Chrome before version 11.0.696.65 allows remote attackers to cause application crashes or potentially have unspecified other impacts via crafted JavaScript code that calls the removeChild method during interaction with a FRAME element.
An integer underflow in the HTMLFormElement::removeFormElement function in WebKit in Google Chrome before version 11.0.696.65 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted HTML document containing a FORM element.
Integer overflow in the FilterEffect::copyImageBytes function in the SVG filter implementation in WebKit in Google Chrome before version 11.0.696.65 may lead to application crashes or other unspecified impacts via crafted dimensions.
In WebKit in Google Chrome before version 11.0.696.65, there is a vulnerability in RenderSVGResourceFilter.cpp that allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted SVG document leading to a 'stale pointer.'
GNOME Shell 3.14.x before 3.14.1 does not limit the aggregate memory consumption of active PrtSc requests, allowing nearby attackers to execute arbitrary commands on an unattended workstation.
CVE-2014-2217 describes a vulnerability in the RadAsyncUpload control in RadControls in Telerik UI for ASP.NET AJAX before Q3 2012 SP2, allowing remote attackers to write to arbitrary files.
Multiple buffer overflows in AllegroSoft RomPager, used in Huawei Home Gateway products and other vendors, allow remote attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors related to authorization.
AllegroSoft RomPager version 4.34 and earlier, used in Huawei Home Gateway products and other vendors, allows remote attackers to gain privileges via a crafted cookie that triggers memory corruption, known as the 'Misfortune Cookie' vulnerability.
Heap-based buffer overflow in the jp2_decode function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 file.
The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.
The QSEECOM driver for Linux kernel 3.x has a vulnerability that does not validate certain offset, length, and base values within an ioctl call. This allows attackers to gain privileges or cause a denial of service via a crafted application.