CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in mediaserver in Android versions 2.2 through 5.x before 5.1 allows attackers to gain privileges.
Apple Mac OS X versions 10.6 through 10.6.3 and Mac OS X Server versions 10.6 through 10.6.3 allow local users to obtain system privileges.
Buffer overflow in ImageIO in Apple Mac OS X 10.6 through 10.6.3 and Mac OS X Server 10.6 through 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a crafted image.
CVE-2017-7219 is a heap overflow vulnerability in Citrix NetScaler Gateway versions 10.1 before 135.8/135.12, 10.5 before 65.11, 11.0 before 70.12, and 11.1 before 52.13. It allows a remote authenticated attacker to execute arbitrary commands via unspecified vectors.
SAP HANA DB version 1.00.73.00.389160 allows remote attackers to execute arbitrary code via vulnerabilities involving the audit logs.
In Netty versions 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final, a vulnerability in OpenSslEngine.java allows remote attackers to cause a denial of service (infinite loop).
The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes.
SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands via the searchFriends function to friends.inc.php.
Multiple SQL injection vulnerabilities in the com.rim.mdm.ui.server.ImageServlet servlet in BlackBerry Enterprise Server 12 (BES12) Self-Service before version 12.4 allow remote attackers to execute arbitrary SQL commands via the imageName parameter.
Shoplat App for iOS versions 1.10.00 through 1.18.00 does not properly verify SSL certificates.
Firejail allows the use of --chroot when seccomp is not supported, which might allow local users to gain privileges.
Firejail does not properly clean environment variables, allowing local users to gain elevated privileges.
Firejail uses weak permissions for /dev/shm/firejail and possibly other files, allowing local users to gain privileges.
Firejail uses 0777 permissions when mounting directories such as /dev, /dev/shm, /var/tmp, and /var/lock, allowing local users to gain elevated privileges.
Firejail uses 0777 permissions when mounting /tmp, which allows local users to gain privileges.
Firejail does not restrict access to --tmpfs, allowing local users to gain privileges, as demonstrated by mounting over /etc.
SeaWell Networks Spectrum SDC version 02.05.00 allows remote viewer users to perform administrative functions.
SeaWell Networks Spectrum SDC version 02.05.00 has a default password of 'admin' for the 'admin' account.
The AMF3CD_AddProp function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to execute arbitrary code.
The AMF3ReadString function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to cause a denial of service through invalid pointer dereference, leading to process crash.