CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An integer underflow in libavcodec/cinepak.c in FFmpeg before version 2.4.2 allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted Cinepak video data.
In libavcodec/pngdec.c in FFmpeg before version 2.4.2, the monochrome-black format is accepted without verifying that the bits-per-pixel value is 1. This allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted PNG data.
In libavcodec/tiff.c in FFmpeg before version 2.4.2, bits-per-pixel fields are not properly validated, allowing remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted TIFF data.
In the libavcodec library in FFmpeg before version 2.4.2, not all lines of HHV Intra blocks are considered during image height validation. This may allow remote attackers to cause a denial of service (out-of-bounds access) or potentially have unspecified other impact via crafted MM video data.
In libavcodec in FFmpeg before version 2.4.2, a certain codec ID is omitted during alignment enforcement, allowing remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted JV data.
In libavcodec/mjpegdec.c in FFmpeg before version 2.4.2, only dimension differences are considered when determining whether an image size has changed, not bits-per-pixel differences. This allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted MJPEG data.
CVE-2014-5417 is a cross-site scripting (XSS) vulnerability in the Meinberg NTP Server firmware on LANTIME M-Series devices version 6.15.019 and earlier. It allows remote attackers to inject arbitrary web scripts or HTML via unspecified vectors.
CVE-2014-5408 is an XSS vulnerability in the login script of the Wind Farm Portal on Nordex Control 2 (NC2) SCADA devices version 15 and earlier. It allows remote attackers to inject arbitrary web scripts or HTML via the username parameter.
The AXN-NET Ethernet module version 3.04 for Accuenergy Acuvim II allows remote attackers to discover passwords and modify settings via vectors involving JavaScript.
The AXN-NET Ethernet module accessory 3.04 for the Accuenergy Acuvim II allows remote attackers to discover passwords and modify settings via vectors involving JavaScript.
ASUS RT-AC68U, RT-AC66R, RT-AC66U, RT-AC56R, RT-AC56U, RT-N66R, RT-N66U, RT-N56R, RT-N56U, and possibly other RT-series routers before firmware version 3.0.0.4.376.x do not verify the integrity of firmware update information or downloaded updates. This allows man-in-the-middle (MITM) attackers to execute arbitrary code via a crafted image.
Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image.
Heap-based buffer overflow in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted config length in a savevm image.
Array index error in the virtio_load function in hw/virtio/virtio.c in QEMU before version 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image.
The virtio_scsi_load_request function in QEMU before version 1.7.2 may allow remote attackers to execute arbitrary code via a crafted savevm image, leading to an out-of-bounds array access.
The usb_device_post_load function in QEMU before version 1.7.2 may allow remote attackers to execute arbitrary code via a crafted savevm image, related to a negative setup_len or setup_index value.
Buffer overflow in scoop_gpio_handler_update in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a large (1) prev_level, (2) gpio_level, or (3) gpio_dir value in a savevm image.
Multiple buffer overflows in the tsc210x_load function in QEMU before version 1.7.2 may allow remote attackers to execute arbitrary code via crafted values in a savevm image.
Multiple buffer overflows in the ssd0323_load function in QEMU before 1.7.2 allow remote attackers to cause a denial of service or possibly execute arbitrary code via crafted values.
The ssi_sd_transfer function in hw/sd/ssi-sd.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted arglen value in a savevm image.