CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Zoho plugin in Pydio (formerly AjaXplorer) before version 5.0.4 has an unrestricted file upload vulnerability. This allows remote attackers to execute arbitrary code by uploading an executable file and accessing it at a location specified by the format parameter of a move operation.
The index.php in Softaculous Webuzo before version 2.1.4 contains a vulnerability that allows remote attackers to execute arbitrary commands via shell metacharacters in a SOFTCookies sid cookie during a login action.
The update function in the TemplateService component in Umbraco CMS before version 6.0.4 does not require authentication, allowing remote attackers to execute arbitrary ASP.NET code via a crafted SOAP request.
Buffer overflow in an ActiveX control in MDraw30.ocx in Schneider Electric ProClima before version 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors.
Buffer overflow in an ActiveX control in MDraw30.ocx in Schneider Electric ProClima before version 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors.
Buffer overflow in an ActiveX control in MDraw30.ocx in Schneider Electric ProClima before version 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors.
Buffer overflow in an ActiveX control in Atx45.ocx in Schneider Electric ProClima before version 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors.
Buffer overflow in an ActiveX control in Atx45.ocx in Schneider Electric ProClima before version 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors.
Vulnerability in apinit on Cray devices with CLE before version 4.2.UP02 and 5.x before version 5.1.UP00, which does not use alpsauth data to validate the UID in a launch message. This allows local users to gain privileges via a modified aprun program.
Multiple stack-based buffer overflows in VideoLAN VLC media player before version 1.0.2 allow remote attackers to execute arbitrary code via crafted ASF, AVI, or MP4 files.
An integer underflow in the real_get_rdt_chunk function in real.c used in VideoLAN VLC media player before 1.0.1 and in MPlayer before r29447 allows remote attackers to execute arbitrary code via a crafted length value in an RDT chunk header.
A heap-based buffer overflow in VideoLAN VLC media player before version 1.0.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted byte stream in an RTMP session.
The ZIP archive decompressor in VideoLAN VLC media player before version 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly execute arbitrary code via a crafted archive.
VideoLAN VLC media player before version 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly execute arbitrary code via a crafted byte stream to the (1) AVI, (2) ASF, or (3) Matroska (aka MKV) demuxer.
Multiple heap-based buffer overflows in VideoLAN VLC media player before version 1.0.6 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted byte stream to the A/52, DTS, or MPEG Audio decoder.
In WebKit in Google Chrome before version 11.0.696.65, there is a bug in RenderSVGText.cpp that improperly casts a variable when handling a block child. This can lead to application crashes or other unknown impacts via a crafted text element in an SVG document.
A use-after-free vulnerability in the FrameView::calculateScrollbarModesForLayout function in WebKit in Google Chrome before version 11.0.696.65 allows remote attackers to cause application crashes or potentially have unspecified other impacts via crafted JavaScript code that calls the removeChild method during interaction with a FRAME element.
An integer underflow in the HTMLFormElement::removeFormElement function in WebKit in Google Chrome before version 11.0.696.65 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted HTML document containing a FORM element.
Integer overflow in the FilterEffect::copyImageBytes function in the SVG filter implementation in WebKit in Google Chrome before version 11.0.696.65 may lead to application crashes or other unspecified impacts via crafted dimensions.
In WebKit in Google Chrome before version 11.0.696.65, there is a vulnerability in RenderSVGResourceFilter.cpp that allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted SVG document leading to a 'stale pointer.'
Vulnerability data from NVD (NIST) · CISA KEV · EPSS