CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SAP AS JAVA SSO Authentication Library versions 2.0 through 3.0 allow remote attackers to cause a denial of service (memory consumption) via large values in the width and height parameters to otp_logon_ui_resources/qr.
Proxifier for Mac before version 2.19.2 allows local users to gain privileges by replacing the KLoader binary with a Trojan horse program.
Hipchat Server before 2.2.3 allows remote authenticated users with Server Administrator level privileges to execute arbitrary code by importing a file.
pmmasterd in Quest Privilege Manager before version 6.0.0.061, when configured as a policy server, allows remote attackers to write to arbitrary files, leading to arbitrary code execution with root privileges via an ACT_NEWFILESENT action.
The .sethalftone5 function in Ghostscript before version 9.21 allows remote attackers to cause application crashes or potentially execute arbitrary code via a crafted Postscript document that calls .sethalftone5 with an empty operand stack.
XmlMapper in the Jackson XML dataformat component before version 2.7.8 and 2.8.x before version 2.8.4 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD.
Sudo versions before 1.8.15 on Linux contain a vulnerability that may allow local users to bypass noexec command restrictions via applications calling the system or popen functions.
The RSA and DSA decryption code in Nettle makes it easier for attackers to discover private keys via a cache side channel attack.
The scm plug-in in mock might allow attackers to bypass the intended chroot protection mechanism and gain root privileges via a crafted spec file.
ZOHO ManageEngine ServiceDesk Plus before 9.0 allows remote authenticated guest users to leverage failure to restrict access to unknown functions, potentially leading to unspecified impact.
In MongoDB 2.6, when using 2.4-style users, remote attackers can cause a denial of service by leveraging in-memory database representation when authenticating against a non-existent database.
In Vtiger CRM 6.4.0, there is an unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class that allows remote authenticated users to execute arbitrary code by uploading a crafted image file with an executable extension.
The crontab script in the ntp package before version 1:4.2.6.p3+dfsg-1ubuntu3.11 on Ubuntu 12.04 LTS, before 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 on Ubuntu 14.04 LTS, on Ubuntu Wily, and before 1:4.2.8p4+dfsg-3ubuntu5.3 on Ubuntu 16.04 LTS allows local users with access to the ntp account to write to arbitrary files, potentially gaining privileges.
IBM Platform LSF 10.1 contains an unspecified vulnerability that could allow a local user to escalate their privileges and obtain root access.
Wolf CMS before 0.8.3.1 allows unrestricted file rename and PHP Code Execution because the file manager does not prevent a change of a file extension to '.php' after originally using the parameter 'filename' for uploading a JPEG image. Exploitation requires a registered user who has access to upload functionality.
Wolf CMS versions before 0.8.3.1 allow unrestricted file upload and PHP Code Execution due to improper validation of the 'filename' parameter in the file manager module. Exploitation requires a registered user with upload access.
Proxifier for Mac before version 2.19 allows local users to gain privileges via the first parameter to the KLoader setuid program.
Moxa MXView 2.8 allows remote attackers to cause a Denial of Service by sending overly long junk payload for the MXView client login credentials.
Moxa MXView 2.8 allows remote attackers to read the web server's private key file, with no access control.
Palo Alto Networks Traps ESM Console before version 3.4.4 allows attackers to cause a denial of service by leveraging improper validation of requests to revoke a Traps agent license.