CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service.
In ImageMagick 7.0.6-1, a memory leak vulnerability was found in the function ReadWMFImage in coders/wmf.c, which allows attackers to cause a denial of service in CloneDrawInfo in draw.c.
An issue was discovered in Varnish HTTP Cache versions 4.0.1 to 4.0.4, 4.1.0 to 4.1.7, 5.0.0, and 5.1.0 to 5.1.2 related to a wrong if statement in the varnishd source code. This bug can lead to an Integer Overflow, causing the varnishd worker process to abort and lose cached content.
In the newusers tool in shadow before version 4.5, there is a possibility to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors.
ImageMagick version 7.0.6-5 has memory leaks in the parse8BIMW and format8BIM functions in coders/meta.c, related to the WriteImage function in MagickCore/constitute.c.
Zoho ManageEngine OpManager versions 11 through 12.2 uses a custom encryption algorithm to protect the credentials used to access monitored devices. The implemented algorithm does not use a per-system key or even a salt, making it possible to create a universal decryptor.
Format Factory version 4.1.0 has a DLL Hijacking vulnerability due to the use of an untrusted search path for msimg32.dll, WindowsCodecs.dll, and dwmapi.dll.
Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the T parameter within Proxy.php.
A proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable installations. The flaw can be exploited by parsing the tr parameter within Proxy.php.
A proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The flaw can be exploited by parsing the 'T' parameter within modTMCSS Proxy.
Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the 't' parameter within modTMCSS Proxy.
Denial of Service vulnerability in Trend Micro Deep Discovery Email Inspector 2.5.1 allows remote attackers to delete arbitrary files on vulnerable installations, thus disabling the service.
Nitro Pro version 11.0.3.173 allows remote attackers to execute arbitrary code via saveAs and launchURL calls with directory traversal sequences.
Buffer overflow in ioquake3 before 2017-08-02 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted packet.
The vulnerability in the OnePlus 2 Primary Bootloader (PBL) is due to the lack of validation of the SBL1 partition before execution, even though it contains a certificate. This allows attackers with write access to that partition to disable signature validation.
CVE-2017-11390 is a vulnerability in XML external entity (XXE) processing in Trend Micro Control Manager 6.0, which could lead to information disclosure if exploited.
Directory traversal vulnerability in Trend Micro Control Manager 6.0 allows remote code execution by attackers able to drop arbitrary files in a web-facing directory.
Trend Micro Control Manager 6.0 has an SQL Injection vulnerability that can lead to Remote Code Execution. The issue arises from improper validation of user-provided strings before constructing SQL queries in RestfulServiceUtility.NET.dll.
CVE-2017-11387 vulnerability in Trend Micro Control Manager 6.0 allows authentication bypass, leading to information disclosure. The issue occurs when authentication validation is not performed for functionality that changes the debug logging level.
Trend Micro Control Manager 6.0 has an SQL Injection vulnerability that can lead to Remote Code Execution. The issue is due to a lack of proper user input validation in cmdHandlerNewReportScheduler.dll.