CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The coders/psd.c file in ImageMagick contains a vulnerability that allows remote attackers to have unspecified impact via a crafted PSD file, leading to an out-of-bounds write.
A memory leak in ImageMagick before version 6.9.7-4 and 7.x before version 7.0.4-4 in coders/mpc.c allows remote attackers to cause a denial of service (memory consumption) via vectors involving a pixel cache.
A double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file.
Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate.
A stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate.
The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certificate.
A double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via crafted policy language information in an X.509 certificate with a Proxy Certificate Information extension.
Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection.
Huawei AR3200 routers with software before V200R007C00SPC600 are vulnerable to remote attacks that can lead to denial of service or execution of arbitrary code via a crafted packet.
The __read_etc_hosts_r function in uClibc-ng before version 1.0.12 allows remote DNS servers to cause a denial of service (infinite loop) via a crafted packet.
The __decode_dotted function in libc/inet/resolv.c in uClibc-ng before version 1.0.12 allows remote DNS servers to cause a denial of service (infinite loop) via vectors involving compressed items in a reply.
Multiple memory leaks in the caption and label handling code in ImageMagick allow remote attackers to cause a denial of service via unspecified vectors.
Off-by-one error in coders/wpg.c in ImageMagick allows remote attackers to have unspecified impact via vectors related to a string copy.
The coders/ipl.c file in ImageMagick contains a vulnerability that allows remote attackers to achieve unspecified impact due to a missing malloc check.
CVE-2016-10133 involves a heap-based buffer overflow in the js_stackoverflow function in jsrun.c in MuJS. Attackers can exploit an error when dropping extra arguments to lightweight functions, leading to unspecified impact.
The MuJS library from Artifex Software, Inc. has a vulnerability that allows attackers to cause a system crash via NULL pointer dereference during regular expression compilation.
The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line.
Buffer overflow in the git_pkt_parse_line function in Git Smart Protocol support in libgit2 before version 0.24.6 and 0.25.x before version 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet.
EyesOfNetwork (EON) version 5.0 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the selected_events[] parameter in the (1) acknowledge, (2) delete, or (3) ownDisown function in module/monitoring_ged/ged_functions.php or the (4) module parameter to module/index.php.
CVE-2017-5869 describes a vulnerability in the file import feature in Nuxeo Platform 6.0, 7.1, 7.2, and 7.3 that allows for directory traversal. Remote authenticated users can upload and execute arbitrary JSP code by exploiting the .. (dot dot) sequence in the X-File-Name header.