CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where improper input parameter handling may lead to denial of service or potential escalation of privileges.
The NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a pointer passed from a user to the driver is used without validation.
The NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where the size of an input buffer is not validated. This may lead to denial of service or potential escalation of privileges.
The NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler where a NULL pointer dereference may lead to a denial of service or potential escalation of privileges.
The NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler where a missing permissions check may allow users to gain access to arbitrary physical system memory, which may lead to an escalation of privileges.
There is a division-by-zero vulnerability in LAME 3.99.5, caused by a malformed input file.
The MEDHOST Document Management System contains hard-coded credentials for accessing Apache Solr. An attacker with knowledge of these credentials and the ability to communicate with Apache Solr may gain access to sensitive patient and financial information.
The MEDHOST Document Management System contains hard-coded credentials used for customer database access. An attacker with knowledge of these credentials and the ability to communicate with the database may obtain or modify sensitive patient and financial information.
The dnxhd_decode_header function in libavcodec/dnxhddec.c in FFmpeg versions 3.0 through 3.3.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via a crafted DNxHD file.
MetInfo through versions 5.3.17 accepts the same CAPTCHA response for 120 seconds, making it easier for remote attackers to bypass intended challenge requirements by modifying the client-server data stream.
In MetInfo versions up to 5.3.17, the job/uploadfile_save.php file blocks the .php extension but not related extensions, which may allow remote authenticated admins to execute arbitrary PHP code by uploading a .phtml file after certain actions.
The psi/ztoken.c file in Artifex Ghostscript 9.21 mishandles references to the scanner state structure, allowing remote attackers to cause application crashes or potentially other unspecified impacts via a crafted PostScript document.
The Boozt Fashion application before version 2.3.4 for Android allows remote attackers to read login credentials by sniffing the network due to the lack of SSL.
NetComm Wireless 4GT101W routers with software version V1.1.8.8 are vulnerable to CSRF attacks, allowing the firewall to be disabled via the administration.html page. The lack of protective tokens makes these attacks easy to execute.
NetComm Wireless 4GT101W routers with Hardware: 0.01 and Software: V1.1.8.8 and Bootloader: 1.1.3 do not require authentication to access logfile.html, status.html, and system_config.html.
SQL injection exists in GLPI before version 9.1.5 in front/devicesoundcard.php via the start parameter.
Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. This acceptance of different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers.
In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continues to crash even for subsequently valid requests.
In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers, making it vulnerable to padding oracle attacks, particularly with CBC mode.
Buffer overflow in AudioCoder 0.8.46 allows remote attackers to execute arbitrary code via a crafted .m3u file.