CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Libav versions before 12.1 are vulnerable to an invalid read of size 1 due to NULL pointer dereferencing in the nsv_read_chunk function in libavformat/nsvdec.c.
libxml2 version 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. The issue exists due to an incomplete fix for CVE-2016-1839.
libxml2 version 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash.
libxml2 version 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c may strcat two more characters to the buffer without checking if the size allows it.
A buffer overflow was discovered in the libxml2 library in the xmlSnprintfElementContent function, which can lead to writing data beyond allocated memory. The issue arises when the buffer length check does not account for the updated length after appending the prefix.
A vulnerability in MikroTik Version 6.38.5 allows an unauthenticated remote attacker to exhaust all available CPU by flooding UDP packets on port 500, preventing the affected router from accepting new connections.
Ipswitch MOVEit Transfer (formerly DMZ) allows pre-authentication blind SQL injection. The fixed versions are MOVEit Transfer 2017 9.0.0.201, MOVEit DMZ 8.3.0.30, and MOVEit DMZ 8.2.0.20.
The readelf.c in GNU Binutils as of 2017-04-12 has a 'shift exponent too large for type unsigned long' issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file.
The readelf.c in GNU Binutils as of 2017-04-12 has a 'cannot be represented in type long' issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file.
SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors.
Session Side jacking vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view, add, and remove users via modification of the HTTP request.
The WebUI component in Deluge before version 1.3.15 contains a directory traversal vulnerability involving a request in which the name of the render file is not associated with any template file.
Quick Emulator (Qemu) with VirtFS support and host directory sharing via Plan 9 File System (9pfs) has an access control vulnerability. This issue can occur when accessing virtfs metadata files in mapped-file security mode, allowing a guest user to escalate their privileges inside the guest.
The Codextrous B2J Contact extension before 2.1.13 for Joomla! allows a directory traversal attack that bypasses a uniqid protection mechanism, making it easier to read arbitrary uploaded files.
smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service.
KDE kdelibs before version 4.14.32 and KAuth before version 5.34 allow local users to gain root privileges by spoofing a callerID and leveraging a privileged helper app.
The Codextrous B2J Contact (b2j_contact) extension before 2.1.13 for Joomla! allows a rename attack that bypasses a 'safe file extension' protection mechanism, leading to remote code execution.
The Codextrous B2J Contact extension before 2.1.13 for Joomla! allows prediction of a uniqid value based on knowledge of a time value. This makes it easier to read arbitrary uploaded files.
Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Zimbra Collaboration before 8.6.0 Patch 8 allow remote attackers to hijack the authentication of administrators for requests that (1) add, (2) modify, or (3) remove accounts. The issue arises from the failure to use a CSRF token and perform referer header checks.
Stack buffer overflow in vshttpd (aka ioos) in HooToo Trip Mate 6 (TM6) firmware 2.000.030 and earlier allows remote unauthenticated attackers to control the program counter via a specially crafted fname parameter of a GET request.