CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The xps_true_callback_glyph_name function in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause an application crash via a crafted file.
The xps_load_sfnt_name function in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause an application crash via a crafted document due to a buffer overflow.
The Ins_IP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact via a crafted document.
The Ins_MIRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.
The xps_load_sfnt_name function in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service through heap-based buffer over-read, leading to application crash. Other unspecified impacts may also be possible.
A flaw in Intel processors from the 6th and 7th Generation and in the Intel Xeon E3-1500M v5 and v6 and E3-1200 v5 and v6 Product Families allows compromised system firmware to impact SGX security via incorrect early system state.
The WP Rocket plugin version 2.9.3 for WordPress has a security vulnerability that allows bypassing the local file inclusion mitigation technique by using 0x00 bytes. An attacker can exploit this vulnerability to perform a Local File Inclusion attack.
A sandbox escape in the Lua interface in Wube Factorio before version 0.15.31 allows remote game servers or user-assisted attackers to execute arbitrary C code by including and loading a C library.
A memory leak was found in SIPcrack 0.2 related to the processing of SIP traffic due to mismanagement of a lines array. A remote attacker could potentially exploit this flaw to crash long-running sipdump sniffing sessions.
Waves MaxxAudio, installed on Dell laptops, adds a Windows service 'WavesSysSvc' with File Version 1.1.6.0, which has a vulnerability known as Unquoted Service Path. This could allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system.
GraphicsMagick 1.3.26 has a heap overflow in the WriteCMYKImage() function in coders/cmyk.c when processing multiple frames that have non-identical widths.
GraphicsMagick 1.3.26 has a NULL pointer dereference in the WriteMAPImage() function in coders/map.c when processing a non-colormapped image. This is a different vulnerability than CVE-2017-11638.
GraphicsMagick version 1.3.26 has a memory leak in the PersistCache function in magick/pixel_cache.c during the writing of Magick Persistent Cache (MPC) files.
GraphicsMagick version 1.3.26 has a segmentation violation in the WriteMAPImage() function in coders/map.c when processing a non-colormapped image. This is a different vulnerability than CVE-2017-11642.
GraphicsMagick version 1.3.26 has a NULL pointer dereference in the WritePCLImage() function in coders/pcl.c during writes of monochrome images.
GraphicsMagick version 1.3.26 has a heap overflow in the WriteRGBImage() function in coders/rgb.c when processing multiple frames with non-identical widths.
Fiyo CMS version 2.0.7 has an SQL injection vulnerability in status.php that uses the id parameter.
Fiyo CMS version 2.0.7 contains a vulnerability that allows remote attackers to delete arbitrary files via directory traversal sequences in the file parameter in a type=database request.
In PHP versions before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zend_ini_do_op() function could lead to denial of service or potentially allow executing code. This issue is relevant for PHP applications that accept untrusted input for the parse_ini_string or parse_ini_file function.
XML External Entity vulnerability in libexpat 2.2.0 and earlier allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.