CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
AVG AntiVirus for MacOS with scan engine before version 4668 may allow remote attackers to bypass malware detection by failing to scan disk image (DMG) files.
Version 7400.12.21.30308 of disp+work in SAP NetWeaver 7.40 allows remote attackers to cause a denial of service (resource consumption) via a crafted DIAG request.
In unrar-free 0.0.1, when _DEBUG_LOG mode is enabled, a stack-based buffer overflow may occur, leading to application crash. Remote attackers can exploit a RAR archive with a long filename to trigger this issue.
CVE-2017-4057 is a privilege escalation vulnerability in the web interface of McAfee Advanced Threat Defense (ATD) versions 3.10, 3.8, 3.6, 3.4, allowing remote authenticated users to gain elevated privileges via the GUI or GUI terminal commands.
Exploitation of an authentication vulnerability in the web interface of McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticated users to bypass ATD detection via loose enforcement of authentication and authorization.
CVE-2017-4054 describes a command injection vulnerability in the web interface of McAfee Advanced Threat Defense (ATD) versions 3.10, 3.8, 3.6, and 3.4. Remote authenticated users can execute arbitrary commands via a crafted HTTP request parameter.
CVE-2017-4053 is a Command Injection vulnerability in the web interface of McAfee Advanced Threat Defense (ATD) versions 3.10, 3.8, 3.6, and 3.4. It allows remote unauthenticated users or attackers to execute arbitrary commands via a crafted HTTP request parameter.
CVE-2017-4052 is an authentication bypass vulnerability in the web interface of McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4. Remote unauthenticated users can change or update configuration settings and gain administrator functionality via a crafted HTTP request parameter.
The ReadDPXImage function in ImageMagick 7.0.6-0 has a large loop vulnerability that can cause CPU exhaustion via a crafted DPX file, related to lack of an EOF check.
phpMyFAQ before 2.9.8 does not properly mitigate brute-force attacks that try many passwords in attempted logins quickly.
FineCMS version 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager 'Add Site' action to enter this code after a ', sequence in a domain name.
A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 allows an attacker to log out active sessions of other users. This issue is related to how it tracks sessions and allows an unauthenticated attacker to view and terminate active sessions from other users.
Podatność CVE-2017-11165 dotyczy urządzenia dataTaker DT80 dEX w wersji 1.50.012, które pozwala zdalnym atakującym na uzyskanie wrażliwych informacji o poświadczeniach i konfiguracji poprzez bezpośrednie żądanie do URI /services/getFile.cmd?userfile=config.xml.
In FineCMS through 2017-07-11, the application/core/controller/style.php file allows remote attackers to write to arbitrary files via the contents and filename parameters in a route=style action. This can lead to overwriting a .php file because the file extension is not checked.
The mq_notify function in the Linux kernel through version 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. This may lead to use-after-free vulnerabilities or other unspecified impacts.
Microsoft Edge on Windows 10 and Windows Server 2016 contains a vulnerability allowing remote code execution related to errors in scripting engines. The issue occurs when handling objects in memory.
Internet Explorer in Microsoft Windows has a vulnerability related to improper rendering of objects in memory by scripting engines, leading to memory corruption. This affects multiple versions of operating systems, including Windows 7, Windows 8.1, and Windows 10.
Microsoft Edge in Windows 10 version 1703 contains a vulnerability allowing remote code execution related to how Microsoft scripting engines render objects in memory.
A vulnerability in Microsoft Edge on Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render objects in memory.
A vulnerability in the JavaScript engine of Microsoft Internet Explorer allows an attacker to execute arbitrary code in the context of the current user. The issue occurs in Windows 10 and Windows Server 2016 when the engine improperly handles objects in memory.