CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An issue was discovered in Oniguruma 6.2.0, used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5, related to a stack out-of-bounds read. Invalid handling of reg->dmin in forward_search_range() could lead to an invalid pointer dereference.
An issue was discovered in Oniguruma 6.2.0, used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5, where a heap out-of-bounds write or read occurs during regular expression compilation. Octal numbers larger than 0xff are not handled correctly, leading to memory corruption.
An issue was discovered in Oniguruma 6.2.0, used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5, related to a stack out-of-bounds write during regular expression compilation. A malformed regular expression could lead to a stack buffer overflow.
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5, related to a stack out-of-bounds read. A logical error in match_at() during regular expression searching could lead to unauthorized reads from a stack buffer.
An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. A specially crafted set of packets can cause a command injection resulting in remote code execution.
A use-after-free vulnerability exists in the .ISO parsing functionality of PowerISO 6.8. A specially crafted .ISO file can lead to potential code execution.
A heap-based buffer overflow vulnerability exists in the Hangul Word Processor component (version 9.6.1.4350) of Hancom Thinkfree Office NEO 9.6.1.4902. A specially crafted document stream can cause an integer underflow leading to a buffer overflow and potential code execution under the application's context.
A stack buffer overflow vulnerability exists in the ISO parsing functionality of PowerISO 6.8. A specially crafted ISO file can lead to potential code execution.
A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting in potential certificate validation vulnerabilities, denial of service and possible remote code execution.
A heap corruption vulnerability exists in the AddSst functionality of Antenna House DMC HTMLFilter as used by MarkLogic 8.0-6. A specially crafted XLS file can cause a heap corruption resulting in arbitrary code execution.
A heap corruption vulnerability exists in the GetIndexArray functionality of Antenna House DMC HTMLFilter as used by MarkLogic 8.0-6. A specially crafted XLS file can cause a heap corruption resulting in arbitrary code execution.
systemd-resolved version 233 allows remote attackers to cause a denial of service (daemon crash) via a crafted DNS response with an empty question section.
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before version 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.
In the Config-Model library before version 2.102, there is a vulnerability that allows local users to gain elevated privileges via a crafted model in the current working directory. The issue is related to the use of '.' in the INC array.
The gen_class_pod implementation in lib/Config/Model/Utils/GenClassPod.pm in Config-Model before version 2.102 contains a dangerous 'use lib' line, allowing remote attackers to have an unspecified impact via a crafted Debian package file.
In Open vSwitch (OvS) 2.7.0, there is a buffer over-read issue when parsing an OFPT_QUEUE_GET_CONFIG_REPLY type OFP 1.0 message. This issue is caused by an unsigned integer underflow in the function `ofputil_pull_queue_get_config_reply10` in `lib/ofp-util.c`.
An exploitable heap overflow vulnerability exists in the ParseEnvironment functionality of AntennaHouse DMC HTMLFilter as used by MarkLogic 8.0-6.
A stack-based buffer overflow vulnerability exists in the DHFSummary functionality of AntennaHouse DMC HTMLFilter as used by MarkLogic 8.0-6. A specially crafted PPT file can cause stack corruption resulting in arbitrary code execution.
A heap corruption vulnerability exists in the UnCompressUnicode functionality of Antenna House DMC HTMLFilter used by MarkLogic 8.0-6. A specially crafted XLS file can cause heap corruption leading to arbitrary code execution.
A heap corruption vulnerability exists in the FillRowFormat functionality of Antenna House DMC HTMLFilter shipped with MarkLogic 8.0-6. A specially crafted xls file can cause heap corruption leading to arbitrary code execution.