CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A heap-based buffer overflow in the decode_dds1 function in libavcodec/dfa.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.
A heap-based buffer overflow in the xwd_decode_frame function in FFmpeg before 2.8.12 and 3.0.x before 3.0.8 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.
A stack-based buffer overflow in the color_string_to_rgba function in libavcodec/xpmdec.c in FFmpeg 3.3 before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.
There is a heap-based buffer overflow in the function hpel_motion in mpegvideo_motion.c in libav 12.1. A crafted input can lead to a remote denial of service attack.
The intr function in sound/oss/msnd_pinnacle.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other impact by changing the value of a message queue head pointer between two kernel reads of that value, aka a 'double fetch' vulnerability.
The snd_msndmidi_input_read function in the Linux kernel through version 4.11.7 allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other impact by changing the value of a message queue head pointer between two kernel reads of that value, known as a 'double fetch' vulnerability.
The snd_msnd_interrupt function in the Linux kernel up to version 4.11.7 allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other impact by changing the value of a message queue head pointer between two kernel reads of that value, known as a 'double fetch' vulnerability.
In systemd versions up to 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, leading to arbitrary data being written beyond its end.
ViMbAdmin 3.0.15 has multiple cross-site request forgery (CSRF) vulnerabilities in the addAction and purgeAction functions that allow remote attackers to hijack the authentication of logged administrators.
CVE-2017-2491 is a 'use after free' vulnerability in the String.replace method in JavaScriptCore in Apple Safari on iOS before version 10.3. It allows remote attackers to execute arbitrary code via a crafted web page or file.
The vulnerability in rhscon-ceph in Red Hat Storage Console 2 x86_64 and Red Hat Storage Console Node 2 x86_64 allows local users to obtain the password in cleartext.
Version 3.1.1 of elog allows remote attackers to post data as any username in the logbook.
FreeIPA version 4.4.0 allows remote attackers to request an arbitrary SAN name for services.
All versions of HPE Helion Openstack Glance have a vulnerability that allows deleted image IDs to be reassigned. This enables remote authenticated users to cause other users to boot into a modified image without notification.
A use after free vulnerability in Adobe Flash Player exists in versions before 20.0.0.267 across various platforms, including Desktop Runtime, Google Chrome, Microsoft Edge, and Internet Explorer. It may lead to unauthorized memory access and potential execution of malicious code.
ManageEngine Firewall Analyzer before version 8.0 does not restrict access permissions, potentially leading to unauthorized access to data.
Logstash versions 1.5.x before 1.5.3 and 1.4.x before 1.4.4 allow remote attackers to read communications between Logstash Forwarder agent and Logstash server.
The res_query function in libresolv in glibc before version 2.25 has a vulnerability that allows remote attackers to cause a denial of service through a NULL pointer dereference, leading to process crashes.
Huawei Ascend P7 allows remote attackers to cause a denial of service by crashing the phone process.
Red Hat Gluster Storage RPM Package 3.2 allows local users to gain privileges and execute arbitrary code as root.