CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in hw/intc/openpic.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements.
Buffer overflow in the pxa2xx_ssp_load function in QEMU before version 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image.
Buffer overflow in target-arm/machine.c in QEMU before version 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a negative value in cpreg_vmstate_array_len in a savevm image.
Buffer overflow in hw/ssi/pl022.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image.
Buffer overflow in hw/pci/pcie_aer.c in QEMU before version 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image.
Buffer overflow in hw/timer/hpet.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via vectors related to the number of timers.
Buffer overflow in hw/ide/ahci.c in QEMU before version 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via vectors related to migrating ports.
The virtio_load function in virtio/virtio.c in QEMU 1.x before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image, which triggers an out-of-bounds write.
The virtio_net_load function in QEMU versions 1.5.0 through 1.7.x before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors in which the value of curr_queues is greater than max_queues, leading to an out-of-bounds write.
Buffer overflow in the virtio_net_load function in net/virtio-net.c in QEMU 1.3.0 through 1.7.x before 1.7.2 might allow remote attackers to execute arbitrary code via a large MAC table.
Integer signedness error in the virtio_net_load function in QEMU 1.x before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image, which triggers a buffer overflow.
CA Cloud Service Management (CSM) before Summer 2014 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Unspecified vulnerability on the HP LaserJet CM3530 Multifunction Printer (CC519A and CC520A) with firmware before version 53.236.2 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service.
SQL injection vulnerability in metadata.xsjs in SAP HANA 1.00.60.379371 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
SAPCRYPTOLIB before version 5.555.38, SAPSECULIB, and CommonCryptoLib before version 8.4.30, used in SAP NetWeaver AS for ABAP and SAP HANA, allow remote attackers to spoof Digital Signature Algorithm (DSA) signatures via unspecified vectors.
The CP Multi View Event Calendar plugin version 1.01 for WordPress has an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the calid parameter.
SQL injection vulnerability in midroll.php in Nuevolab Nuevoplayer for ClipShare 8.0 and earlier allows remote attackers to execute arbitrary SQL commands via the ch parameter.
The vulnerability in Akeeba Restore (restore.php) allows remote attackers to bypass encryption and execute arbitrary code via a command message that extracts a crafted archive. This affects multiple versions of Joomla!, Akeeba Backup, and other components.
The apt-get download command in APT before version 1.0.9 does not properly validate signatures for packages, allowing remote attackers to execute arbitrary code via a crafted package.
APT versions before 1.0.9, when the Acquire::GzipIndexes option is enabled, do not validate checksums, allowing remote attackers to execute arbitrary code via a crafted package.