CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Incorrect interaction of the parse_packet() and parse_part_sign_sha256() functions in network.c in collectd 5.7.1 and earlier allows remote attackers to cause a denial of service (infinite loop) of a collectd instance (configured with 'SecurityLevel None' and with empty 'AuthFile' options) via a crafted UDP packet.
The dalvik_disassemble function in radare2 version 1.2.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted DEX file.
The _zval_get_long_func_ex function in PHP 7.1.2 has a vulnerability that allows attackers to cause a denial of service through crafted use of 'declare(ticks=' in a PHP script, leading to a NULL pointer dereference and application crash.
The relocs function in libr/bin/p/bin_bflt.c in radare2 version 1.2.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.
The parse_char_class function in regparse.c in the Onigmo (aka Oniguruma-mod) regular expression library, as used in Ruby 2.4.0, allows remote attackers to cause a denial of service (deep recursion and application crash) via a crafted regular expression.
JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 22, allows remote attackers to cause a denial of service through heap-based out-of-bounds write, leading to application crash. The attack can be executed via crafted JavaScript code that triggers access to red-zone memory locations.
YARA 3.5.0 has a vulnerability that allows remote attackers to cause a denial of service through a crafted rule mishandled in the yr_compiler_destroy function, leading to a use-after-free error and application crash.
YARA 3.5.0 has a vulnerability that allows remote attackers to cause a denial of service through a crafted rule, leading to a heap-based out-of-bounds read and application crash.
Devices Jensen of Scandinavia AS Air:Link 3G, Air:Link 5000AC, and Air:Link 59300 have a vulnerability that allows remote attackers to read passwords via a direct request to the x.asp page.
Devices Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC) version 1.13, and Air:Link 59300 (AL59300) version 1.04 (Rev. 4) are vulnerable to CSRF attacks that can be conducted by remote attackers via certain /goform/* pages.
Devices Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC) version 1.13, and Air:Link 59300 (AL59300) version 1.04 (Rev. 4) allow remote attackers to execute arbitrary commands via shell metacharacters to certain /goform/* pages.
JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 18, allows remote attackers to cause a denial of service via crafted JavaScript code mishandled in the operatorString function, leading to bitfield out-of-bounds read and application crash.
In JavaScriptCore in WebKit, included in Safari Technology Preview Release 18, there is a vulnerability that allows remote attackers to cause a denial of service through crafted JavaScript code. This issue involves 'type confusion' in the JSON.stringify function, leading to segmentation violation and application crash.
YARA 3.5.0 has a vulnerability that allows remote attackers to cause a denial of service through a crafted rule mishandled in the yr_parser_lookup_loop_variable function, leading to a use-after-free error and application crash.
In YARA 3.5.0, a vulnerability allows remote attackers to cause application crashes via a crafted rule, leading to a NULL pointer dereference in the yy_get_next_buffer function.
The register_routes function in the REST API of WordPress versions 4.7.x before 4.7.2 does not require an integer identifier, allowing remote attackers to modify arbitrary pages via a crafted request.
The maintenance module in Huawei FusionStorage V100R003C30U1 allows attackers to create documents according to special rules to obtain the OS root privilege of FusionStorage.
Huawei OceanStor 5600 V3 with V300R003C00C10 and earlier versions allows attackers with administrator privilege to inject a command into a specific command's parameters, and run this injected command with root privilege.
Huawei USG5500 with software V300R001C00 allows attackers to bypass the anti-DDoS module, leading to a denial of service condition on the backend server.
Huawei AR3200, S12700, S5300, S5700, S6300, S6700, S7700, S9300, and S9700 devices with specific software versions are vulnerable to remote attacks that can lead to memory exhaustion by sending abnormal MPLS packets.