CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2015-8107 in GNU a2ps 4.14 has a format string vulnerability that allows remote attackers to execute arbitrary code.
A buffer underflow vulnerability exists in the Debian inspircd package before version 2.0.5-1+deb7u1 for wheezy and before version 2.0.16-1 for jessie and sid. This issue arises from an incomplete fix of CVE-2012-1836.
InspIRCd before 2.0.7 allows remote attackers to cause a denial of service (infinite loop).
The 'Smart related articles' extension version 1.1 for Joomla! has an SQL injection vulnerability in dialog.php. An attacker must use the search_cats variable in the POST method to exploit this vulnerability.
In Wireshark versions 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the WSP dissector could enter an infinite loop, triggered by packet injection or a malformed capture file. This was addressed by adding a length check.
In Wireshark versions 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the PacketBB dissector could crash due to packet injection or a malformed capture file. This was addressed by restricting additions to the protocol tree.
In Wireshark versions 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the SLSK dissector could enter an infinite loop triggered by packet injection or a malformed capture file. This was addressed by adding checks for the remaining length.
In Wireshark versions 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the SIGCOMP dissector could enter an infinite loop, triggered by packet injection or a malformed capture file. This was addressed by correcting a memory-size check.
In Wireshark versions 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the RPC over RDMA dissector could enter an infinite loop, triggered by packet injection or a malformed capture file. This was addressed by correctly checking for going beyond the maximum offset.
In Wireshark versions 2.2.0 to 2.2.5, the DOF dissector had an issue that could lead to an infinite loop, triggered by packet injection or a malformed capture file. This was addressed by using a different integer data type and adjusting a return value.
In Wireshark versions 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the IMAP dissector could crash due to packet injection or a malformed capture file. This was addressed by correctly calculating a line's end in packet-imap.c.
In Wireshark versions 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the WBXML dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed by adding length validation.
In Wireshark versions 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the BGP dissector could enter an infinite loop, triggered by packet injection or a malformed capture file. This was addressed by using a different integer data type.
An attacker that has hijacked a Unitrends Enterprise Backup (before 9.1.2) web server session can leverage api/includes/users.php to change the password of the logged in account without knowing the current password. This allows for an account takeover.
An issue was discovered in Unitrends Enterprise Backup before version 9.1.2 related to a lack of input sanitization in the createReportName and saveReport functions. This allows an authenticated user to create a randomly named file on disk with a user-controlled extension, contents, and path, leading to remote code execution.
An issue was discovered in api/includes/systems.php in Unitrends Enterprise Backup before version 9.0.0. User input is not properly filtered before being sent to a popen function, allowing for remote code execution.
An unprivileged user of the Unitrends Enterprise Backup before version 9.0.0 can escalate to root privileges by modifying the 'token' cookie issued at login.
OpenStack Nova-LXD before 13.1.1 uses the wrong name for the veth pairs when applying Neutron security group rules for instances, which allows remote attackers to bypass intended security restrictions.
The Qualcomm SPCom driver in the Android kernel dated 2017-03-05 has a vulnerability that allows local users to gain elevated privileges. This is a different vulnerability than CVE-2016-5857.
Symantec Web Gateway (SWG) before 5.2.5 allows remote authenticated users to execute arbitrary OS commands.