CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Foreman versions from 1.1 to before 1.9.0-RC1 do not redirect HTTP requests to HTTPS when the require_ssl setting is enabled. This allows remote attackers to obtain user credentials via a man-in-the-middle attack.
The weblog page template in Apache Roller versions 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language (aka VTL).
The read_user_chunk_callback function in coders/png.c in ImageMagick 7.0.6-1 Q16 from June 21, 2017 (beta) has memory leak vulnerabilities via crafted PNG files.
The HTTP/2 handling code in Apache httpd 2.4.26 has an issue that may lead to accessing memory after it has been freed, especially when closing many connections under stress. This can result in erratic application behavior.
In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. This could lead to leakage of potentially confidential information and a segfault in other cases resulting in denial of service.
CVE-2017-6249 is a vulnerability in the NVIDIA sound driver that allows for privilege escalation, enabling a local malicious application to execute arbitrary code within the kernel context. However, it requires compromising a privileged process first.
Using Spring AOP functionality to secure Struts actions can lead to a DoS attack.
IBM BigFix Inventory v9.2 uses inadequate account lockout settings that could allow a remote attacker to brute force account credentials.
IBM Emptoris Strategic Supply Management Platform versions 10.0.0.x through 10.1.1.x is vulnerable to a denial of service attack. An attacker can exploit a vulnerability in the authentication features that could log out users and flood user accounts with emails.
Nginx versions from 0.5.6 to 1.13.2 are vulnerable to an integer overflow in the nginx range filter module, leading to a leak of potentially sensitive information triggered by specially crafted requests.
Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in a way that violates the Kerberos 5 protocol specification.
Missing anchor in generated regex for rack-cors before version 0.4.1 allows a malicious third-party site to perform CORS requests. A configuration intended to allow only the trusted example.com domain may inadvertently allow example.com.example.net and example.com-example.net.
FineCMS has an SQL Injection vulnerability affecting the visitor_ip parameter in application/core/controller/excludes.php. This issue was identified up to July 12, 2017.
In install/page_dbsettings.php in the Core distribution of XOOPS 2.5.8.1, unfiltered data passed to CREATE and ALTER SQL queries caused SQL Injection in the database settings page.
Pulse Connect Secure 8.3R1 has a CSRF vulnerability in logout.cgi. The logout function of the admin panel is not protected by any CSRF tokens, allowing an attacker to log out a user by tricking them into visiting a malicious web page.
Pulse Connect Secure 8.3R1 has a CSRF vulnerability in the diag.cgi file, which allows commands like ping, traceroute, and nslookup to be executed. The lack of CSRF protections enables an attacker to run these commands against any IP if they can trick an admin into visiting their malicious page.
An out-of-bounds write vulnerability exists in the PDF parsing functionality of Infix 7.1.5. A specially crafted PDF file can cause a vulnerability resulting in potential memory corruption.
An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of Poppler 0.53.0. Opening a specially crafted PDF file can lead to an overflow, resulting in out of bounds memory overwrite on the heap and potential arbitrary code execution.
A heap overflow vulnerability exists in the image rendering functionality of Poppler 0.53.0. A specifically crafted PDF can cause an overly large number of color components during image rendering, resulting in heap corruption.
A heap overflow vulnerability exists in the image rendering functionality of Poppler 0.53.0. A specifically crafted PDF can cause an image resizing after allocation has already occurred, leading to heap corruption and potential code execution.