CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
There is a floating point exception in the Exiv2::ValueType function in Exiv2 version 0.26 that can lead to a remote denial of service attack via crafted input.
There is a NULL pointer dereference in the caseless_hash function in gxps-archive.c in libgxps 0.2.5. A crafted input will lead to a remote denial of service attack.
On Cisco DDR2200 and DDR2201v1 devices, there is no access control for several configuration files, which may lead to unauthorized access to sensitive information.
Cisco DDR2200 and DDR2201v1 devices are vulnerable to remote command execution via shell metacharacters in the pingAddr parameter to the waitPingqry.cgi URI. The command output is visible in /PingMsg.cmd.
There is a directory traversal vulnerability in the filename parameter to the /download.conf URI on Cisco DDR2200 and DDR2201v1 devices.
FineCms version 5.0.9 has a vulnerability allowing remote PHP code execution via the 'param' parameter in an action=cache request to libraries/Template.php, known as Eval Injection.
FineCms version 5.0.9 has a SQL Injection vulnerability via the field parameter in requests with actions module, member, form, or related to the libraries/Template.php file.
FineCms version 5.0.9 has a SQL Injection vulnerability via the catid parameter in an action=related request to libraries/Template.php.
FineCms version 5.0.9 has an SQL Injection vulnerability via the num parameter in action=related or action=tags requests to libraries/Template.php.
FontForge version 20161012 is vulnerable to a buffer over-read in getsid (parsettf.c), which may lead to DoS or code execution via a crafted otf file.
FontForge version 20161012 is vulnerable to a buffer over-read in the strnmatch function (char.c), which may lead to DoS or code execution via a crafted otf file.
FontForge version 20161012 is vulnerable to a heap-based buffer overflow in the readcffset function (parsettf.c), which may lead to DoS attacks or code execution via a crafted otf file.
FontForge version 20161012 is vulnerable to a buffer over-read in ValidatePostScriptFontName (parsettf.c), which may lead to DoS or code execution via a crafted otf file.
FontForge version 20161012 is vulnerable to a heap-based buffer over-read in the readcfftopdicts function (parsettf.c), which may lead to DoS or code execution via a crafted otf file.
FontForge version 20161012 is vulnerable to a stack-based buffer overflow in the addnibble function (parsettf.c), potentially leading to DoS or code execution via a crafted otf file.
FontForge version 20161012 is vulnerable to a buffer over-read in umodenc (parsettf.c), which may lead to DoS or code execution via a crafted otf file.
FontForge version 20161012 is vulnerable to a heap-based buffer over-read in readttfcopyrights (parsettf.c), potentially leading to DoS or code execution via a crafted otf file.
FontForge version 20161012 is vulnerable to a heap-based buffer over-read in PSCharStringToSplines (psread.c), which may lead to DoS or code execution via a crafted otf file.
In the Debian tor_0.2.9.11-1~deb9u1 package, the debian/tor.init script was designed to execute aa-exec from the standard system pathname if the AppArmor package is installed, but this implementation is incorrect. This allows attackers to bypass intended AppArmor restrictions.
There is a stack consumption vulnerability in the Parser::advanceToNextToken function in parser.cpp in LibSass 3.4.5. A crafted input may lead to remote denial of service.