CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. It is possible to create a specially crafted node name that does not exist as part of the cluster and point it to a malicious node, which can trick other nodes in the cluster.
The ReadOneJNGImage function in GraphicsMagick 1.3.26 allows remote attackers to cause an application crash during JNG reading via a zero-length color_image data structure.
SWFTools version 0.9.2, when processing a crafted file in swfcombine, can lead to a NULL Pointer Dereference in the swf_Relocate() function in lib/modules/swftools.c.
CVE-2017-11100 affects SWFTools version 0.9.2, where processing a crafted file in the swfextract tool can lead to a NULL Pointer Dereference in the swf_FoldSprite() function.
A vulnerability in SWFTools 0.9.2 occurs when processing a crafted file in wav2swf, which can lead to a Segmentation Violation in the wav_convert2mono() function in lib/wav.c.
CVE-2017-11098 affects SWFTools version 0.9.2, where processing a crafted file in png2swf can lead to a Segmentation Violation in the png_load() function in lib/png.c.
SWFTools version 0.9.2, when processing a crafted file in swfc, can lead to a NULL Pointer Dereference in the dict_lookup() function in lib/q.c.
CVE-2017-11096 affects SWFTools 0.9.2, where processing a crafted file in swfcombine can lead to a NULL Pointer Dereference in the swf_DeleteFilter() function in lib/modules/swffilter.c.
A Null Pointer Dereference issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2017.426.2307.1 and prior. This vulnerability could allow an attacker to crash the logger process, causing a denial of service for logging and log-viewing.
A Stack-Based Buffer Overflow issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2017.426.2307.1 and prior. This vulnerability may allow a remote attacker to execute arbitrary code in the context of a highly privileged account.
An Uncontrolled Resource Consumption issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2017.426.2307.1 and prior. This vulnerability could allow an attacker to exhaust the memory resources of the machine, causing a denial of service.
An Improper Authentication issue was discovered in Siemens SIMATIC CP 44x-1 RNA, all versions prior to 1.4.1. An unauthenticated remote attacker may be able to perform administrative actions on the Communication Process (CP) of the RNA series module, if network access to Port 102/TCP is available and the configuration file for the CP is stored on the RNA's CPU.
The `ares_parse_naptr_reply()` function in the c-ares library may read memory outside of the given input buffer if the passed DNS response packet is crafted in a specific way.
systemd v233 and earlier fails to safely parse usernames starting with a numeric digit, resulting in the service running with root privileges instead of the intended user privileges.
A race condition in the bindBackupAgent method in ActivityManagerService in Android 4.4.4 allows local users with adb shell access to execute arbitrary code or any valid package as system.
Foxit Reader before version 8.3.1 and PhantomPDF before version 8.3.1 have an Arbitrary Write vulnerability, allowing remote attackers to execute arbitrary code via a crafted document.
A directory traversal vulnerability in node/utils/Minify.js in Etherpad versions 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by manipulating the path parameter in HTTP API requests.
An issue was discovered in Irssi before version 1.0.4 related to updating the internal nick list. The application could incorrectly use the GHashTable interface, leading to freeing the nick during the update, resulting in use-after-free conditions on each access of the hash table.
An issue was discovered in Irssi before version 1.0.4, which occurs when receiving messages with invalid time stamps. In this case, Irssi attempts to dereference a NULL pointer.
CVE-2017-0340 describes an elevation of privilege vulnerability in the NVIDIA Libnvparser component due to a memcpy into a fixed sized buffer with a user-controlled size, which could lead to memory corruption and possible remote code execution.