CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Sendio versions before 8.2.1 were affected by a Local File Inclusion vulnerability that allowed an unauthenticated, remote attacker to read potentially sensitive system files via a specially crafted URL.
Avira Antivirus engine versions before 8.3.36.60 allow remote code execution as NT AUTHORITY\SYSTEM via a section header with a very large relative virtual address in a PE file, causing an integer overflow and heap-based buffer underflow.
Buffer overflow in MediaCoder 0.8.48.5888 allows remote attackers to execute arbitrary code via a crafted .m3u file.
The ff_amf_get_field_value function in libavformat/rtmppkt.c in FFmpeg 3.3.2 allows remote RTMP servers to cause a denial of service via a crafted stream, leading to segmentation violation and application crash.
The fill_input_buffer function in jdatasrc.c in libjpeg-turbo 1.5.1 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted jpg file.
There is an illegal address access in the build_table function in libavcodec/bitstream.c of Libav 12.1 that may lead to remote denial of service via crafted input.
CVE-2017-11681 vulnerability in Hashtopussy 0.4.0 concerns incorrect access control, allowing remote authenticated users to perform actions reserved for administrative roles, as demonstrated by an action=createVoucher request to agents.php.
Hashtopussy 0.4.0 has a Cross-Site Request Forgery (CSRF) vulnerability that allows an admin password change via users.php.
Hashtopus 1.5g has a Cross-Site Request Forgery (CSRF) vulnerability via the password parameter to admin.php in an a=config action.
SQL injection vulnerability in Hashtopus 1.5g allows remote authenticated users to execute arbitrary SQL commands via the format parameter in admin.php.
The traverseStrictSanitize function in AdminRequestSanitizer.php in ZenCart 1.5.5e mishandles key strings, allowing remote authenticated users to execute arbitrary PHP code by placing that code into an invalid array index of the admin_name array parameter to admin_dir/login.php.
Reporter.exe in Acunetix 8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a malformed PRE file, related to a 'User Mode Write AV starting at reporter!madTraceProcess.'
A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server versions 2.4.24 and 2.4.25 to dereference a NULL pointer and crash the server process.
OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, allowing remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session.
The gs_alloc_ref_array function in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted PostScript document. This is related to a lack of an integer overflow check in base/gsalloc.c.
The xps_decode_font_char_imp function in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service through heap-based buffer over-read, leading to application crash. The attack can be executed via a crafted document.
The Ins_JMPR function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.
The gx_ttfReader__Read function in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service through heap-based buffer over-read, leading to application crash.
The Ins_MDRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.
The xps_select_font_encoding function in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service through heap-based buffer over-read and application crash via a crafted document.