CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A memory leak in AcquireVirtualMemory in ImageMagick before version 7 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.
The MWOAuthDataStore::lookup_token function in the OAuth extension for MediaWiki versions 1.25.x before 1.25.3, 1.24.x before 1.24.4, and before 1.23.11 does not properly validate the signature when checking the authorization signature. This allows remote registered Consumers to use another Consumer's credentials by leveraging knowledge of those credentials.
aRts 1.5.10 and kdelibs3 3.5.10 and earlier do not properly create temporary directories, allowing local users to hijack IPC by pre-creating the temporary directory.
Node.js versions from 4.0 to 4.8.3, all 5.x versions, and versions 6.0 to 6.11.0, 7.0 to 7.10.0, and 8.0 to 8.1.3 were susceptible to hash flooding DoS attacks. This was due to the HashTable seed being constant across a given released version of Node.js.
An issue was discovered in the Cloud Foundry Foundation CAPI-release in versions after v1.6.0 and prior to v1.35.0 and cf-release versions after v244 and prior to v268. A carefully crafted CAPI request from a Space Developer can allow them to gain access to files on the Cloud Controller VM for that installation.
A filesystem traversal vulnerability was discovered in the Cloud Controller API in CAPI-release versions prior to v1.35.0 and cf-release versions prior to v268. It allows a space developer to escalate privileges by pushing a specially crafted application that can write arbitrary files to the Cloud Controller VM.
The brcmf_cfg80211_mgmt_tx function in the Linux kernel before version 4.12.3 allows local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted NL80211_CMD_FRAME Netlink packet.
The vulnerability in snwrite.cgi in the AirLink101 SkyIPCam1620W allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the mac parameter.
The cgi_test.cgi in AirLive devices BU-2015, BU-3026, and MD-3025 has a vulnerability that allows remote attackers to execute arbitrary OS commands via shell metacharacters after an '&' in specific parameters.
Directory traversal vulnerability in the web request/response interface in Appserver before 1.0.3 allows remote attackers to read normally inaccessible files via a .. (dot dot) in a crafted URL.
IBM WebSphere Application Server versions 7.0, 8.0, 8.5, and 9.0 may create files with default permissions instead of customized ones when custom startup scripts are used. A local attacker could exploit this to gain access to files with an unknown impact.
A design flaw in SYNO.API.Encryption in Synology DiskStation Manager (DSM) before version 6.1.3-15152 allows remote attackers to bypass the encryption protection mechanism via a crafted version parameter.
An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release version 1.33.0 that allows a space developer to execute arbitrary code on the Cloud Controller VM by pushing a specially crafted application.
In NTP ntpd versions 4.2.x before 4.2.8p4 and 4.3.x before 4.3.77, the 'pidfile' or 'driftfile' directives allow remote attackers with access to configuration to write to arbitrary files via the :config command.
An issue was discovered in Tilde CMS version 1.0.1 that allows bypassing the implemented restrictions on arbitrary file upload via filename manipulation with .php extension.
An issue was discovered in Tilde CMS version 1.0.1 that allows arbitrary files to be read via a file=../ attack on actionphp/download.File.php.
An issue was discovered in Tilde CMS version 1.0.1 due to missing escaping of the backtick character, leading to SQL Injection vulnerability in the SELECT query in class.SystemAction.php.
Statamic framework before 2.6.0 does not correctly check a session's permissions when the methods from a user's class are called. Problematic methods include reset password, create new account, create new role, etc.
In the Linux kernel up to version 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, the dir value of xfrm_userpolicy_id is not ensured to be XFRM_POLICY_MAX or less. This can lead to denial of service (out-of-bounds access) or possibly other unspecified impacts via an XFRM_MSG_MIGRATE xfrm Netlink message.
There is a Mismatched Memory Management Routines vulnerability in the Exiv2::FileIo::seek function of Exiv2 0.26 that will lead to a remote denial of service attack (heap memory corruption) via crafted input.