CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A remote code execution vulnerability exists in Microsoft Chakra Core related to the way JavaScript engines render when handling objects in memory. This is known as 'Scripting Engine Memory Corruption Vulnerability'.
The Apache Qpid Broker for Java has a vulnerability that allows premature termination of SCRAM SASL negotiation if the provided username does not exist. This enables a remote attacker to determine the existence of user accounts.
Zoho ManageEngine Desktop Central before build 100082 allows remote attackers to obtain control over all connected active desktops via unspecified vectors.
Multiple cross-site request forgery (CSRF) vulnerabilities in Simple Invoices 2013.1.beta.8 allow remote attackers to hijack the authentication of admins for requests that can create new administrator user accounts, create regular user accounts, or change configuration parameters.
The sized_string_cmp function in libyara/sizedstr.c in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule.
Mailcow version 0.14, used in 'mailcow: dockerized' and other products, has a CSRF vulnerability.
The ipxitf_ioctl function in the Linux kernel through version 4.11.1 mishandles reference counts, allowing local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a failed SIOCGIFADDR ioctl call for an IPX interface.
In Ambari 2.4.x (before 2.4.3) and Ambari 2.5.0, an authorized user of the Ambari Hive View may be able to gain unauthorized read access to files on the host where the Ambari server executes.
The zend_string_extend function in PHP through version 7.1.5 does not prevent changes to string objects that can lead to negative length. This allows remote attackers to cause application crashes or potentially other unspecified impacts by leveraging the .= operator with a long string.
In function msm_pcm_playback_close() in all Android releases from CAF using the Linux kernel, prtd is assigned substream->runtime->private_data. Later, prtd is freed but not sanitized or set to NULL, resulting in a dangling pointer.
All Android releases from CAF using the Linux kernel are vulnerable to an issue related to processing a voice SVC request. When a nonstandard payload size is specified that exceeds its declared size, an out of bounds memory copy occurs.
In core_info_read and inst_info_read in all Android releases from CAF, variables 'dbg_buf', 'dbg_buf->curr', and 'dbg_buf->filled_size' can be modified simultaneously by different threads, leading to a lack of protection with mutexes or locks. Buffer overflow is possible on race conditions.
CVE-2016-10331 is a vulnerability in download.php in Synology Photo Station before version 6.5.3-3226 that allows remote attackers to read arbitrary files via a full pathname in the id parameter.
Directory traversal vulnerability in synophoto_dsm_user, a SUID program, as used in Synology Photo Station before version 6.5.3-3226 allows local users to write to arbitrary files via unspecified vectors.
CVE-2016-10329 is a vulnerability in login.php in Synology Photo Station before version 6.5.3-3226 that allows remote attackers to execute arbitrary code via shell metacharacters in the 'X-Forwarded-For' header.
In FlightGear versions before 2017.2.1, the FGCommand interface allows overwriting any file the user has write access to, but only with the contents of a FlightGear flightplan (XML). A malicious resource, such as a third-party aircraft, could exploit this to damage user files.
PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server.
Some selectivity estimation functions in PostgreSQL before version 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, potentially leaking data. An unprivileged attacker could exploit this flaw to steal information from tables they would otherwise not have access to.
It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks.
CVE-2017-2167 describes an untrusted search path vulnerability in the Installer for PrimeDrive Desktop Application version 1.4.4 and earlier, allowing remote attackers to execute arbitrary code via a specially crafted executable file in an unspecified directory.