CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in APNGDis 2.8 and below allows a remote attacker to execute arbitrary code via a crafted filename.
The ip6gre_err function in the Linux kernel allows remote attackers to have unspecified impact via vectors involving GRE flags in an IPv6 packet, leading to out-of-bounds access.
The kbase_dispatch function in the GPU driver on Samsung devices with M(6.0) and N(7.0) software and Exynos AP chipsets allows attackers to have unspecified impact via unknown vectors, leading to an out-of-bounds read.
QNAP QTS before version 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by reading data in an XOR format within the /etc/config/uLinux.conf configuration file.
Firejail before 0.9.44.4, when running a bandwidth command, allows local users to gain root privileges via the --shell argument.
Firejail before 0.9.44.4, when running on a Linux kernel before 4.8, allows context-dependent attackers to bypass a seccomp-based sandbox protection mechanism via the --allow-debuggers argument.
The postrm script in the tomcat6, tomcat7, and tomcat8 packages on various versions of Debian and Ubuntu may allow local users with access to the tomcat account to gain root privileges via a setgid program in the Catalina directory.
The postinst script in the tomcat6, tomcat7, and tomcat8 packages on various versions of Debian and Ubuntu may allow local users with access to the tomcat account to obtain sensitive information or gain root privileges via a symlink attack on the Catalina localhost directory.
NDSD in Novell eDirectory before 9.0.2 did not calculate ACLs on LDAP objects across partition boundaries correctly, which could lead to a privilege escalation by modifying user attributes that would otherwise be filtered by an ACL.
A cross site request forgery protection mechanism in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be circumvented by repeated uploads causing a high load.
The iManager Admin Console in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to iFrame manipulation attacks, potentially allowing remote users to access authentication credentials.
The presence of a .htaccess file in NetIQ Access Manager 4.1 before version 4.1.2 Hot Fix 1 and 4.2 before SP2 may lead to information leakage.
The SAML2 implementation in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 was handling unsigned SAML requests incorrectly, leaking results to a potentially malicious 'Assertion Consumer Service URL' instead of the original requester.
The certificate upload feature in iManager in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to upload JSP pages that would be executed as the iManager user, allowing code execution by logged-in remote users.
A vulnerability in cookie handling in the http stack implementation in NDSD in Novell eDirectory before 9.0.1 allows remote attackers to bypass intended access restrictions by leveraging predictable cookies.
A code injection vulnerability in the supportconfig data collection tool in supportutils in SUSE Linux Enterprise Server 12 and 12-SP1 and SUSE Linux Enterprise Desktop 12 and 12-SP1 could allow local attackers to execute code as the user running supportconfig (usually root).
A logged-in user in NetIQ Access Governance Suite versions 6.0 through 6.4 could escalate privileges to administrator.
An issue was discovered in cloudflare-scrape versions 1.6.6 to 1.7.1 that allows a malicious website owner to execute arbitrary Python code on any cfscrape user scraping that website.
AlienVault USM and OSSIM before version 5.3.7 and NfSen before version 1.3.8 have an error in privilege dropping, resulting in unnecessary execution of NfSen Perl code as root.
A vulnerability in the DHCP client implementation of Cisco IOS and Cisco IOS XE could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. It occurs during the parsing of a crafted DHCP packet.