CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.24)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
There is a sensitive information disclosure vulnerability in document.php in Dolibarr ERP/CRM version 6.0.0 via the file parameter.
SQL injection vulnerability in admin/menus/edit.php in Dolibarr ERP/CRM version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the menuId parameter.
In the mboxlist_do_find function in Cyrus IMAP before version 3.0.4, an off-by-one error in prefix calculation for the LIST command led to the use of uninitialized memory. This may allow remote attackers to obtain sensitive information or cause a daemon crash.
There is an infinite loop in the jpc_dec_tileinit function in jpc/jpc_dec.c of Jasper 2.0.13, which may lead to a remote denial of service attack.
In MongoDB libbson version 1.7.0, the bson_iter_codewscope function miscalculates a length argument in bson_utf8_validate, allowing remote attackers to cause a denial of service.
In WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1, iterators are mishandled, allowing remote attackers to cause a denial of service through heap-based buffer over-read in the WPXTableList class. This vulnerability can be triggered in LibreOffice before version 5.3.7.
The av_color_primaries_name function in libavutil/pixdesc.c in FFmpeg 3.3.3 may return a NULL pointer depending on a value contained in a file, leading to a NULL pointer dereference in the avcodec_string function in libavcodec/utils.c.
A heap-based buffer overflow in WritePCXImage in coders/pcx.c in ImageMagick 7.0.6-8 Q16 allows remote attackers to cause a denial of service or code execution via a crafted file.
A Missing Authentication for Critical Function issue was discovered in OPW Fuel Management Systems SiteSentinel Integra 100, Integra 500, and iSite ATG consoles. An attacker may create an application user account to gain administrative privileges.
A SQL Injection issue was discovered in OPW Fuel Management Systems SiteSentinel Integra 100, SiteSentinel Integra 500, and SiteSentinel iSite ATG consoles. The application is vulnerable to injection of malicious SQL queries via the input from the client.
An Incorrect Default Permissions issue was discovered in AzeoTech DAQFactory versions prior to 17.1. Local, non-administrative users may be able to replace or modify original application files with malicious ones.
An elevation of privilege vulnerability in the MediaTek mmc driver. Affects Android, including the Android kernel.
CVE-2017-0803 is a privilege escalation vulnerability in the MediaTek accessory detector driver affecting the Android kernel.
An elevation of privilege vulnerability in the MediaTek kernel. Affects Android and its kernel.
CVE-2017-0801 is a privilege escalation vulnerability in the MediaTek libmtkomxvdec library in Android. It affects the Android kernel.
CVE-2017-0800 is a privilege escalation vulnerability in the MediaTek teei module in the Android kernel. This issue affects various versions of the Android kernel.
CVE-2017-0799 is an elevation of privilege vulnerability in the MediaTek lastbus in the Android kernel. The issue affects Android kernel versions and may allow unauthorized access to system resources.
An elevation of privilege vulnerability in the MediaTek kernel. It affects Android, potentially allowing attackers to gain higher privileges in the system.
CVE-2017-0797 is a privilege escalation vulnerability in the MediaTek accessory detector driver affecting the Android kernel.
CVE-2017-0796 is a privilege escalation vulnerability in the MediaTek auxadc driver affecting the Android kernel.