CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in the DHCP code for the Zero Touch Provisioning feature of Cisco ASR 920 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause an affected device to reload. This is due to a format string vulnerability when processing a crafted DHCP packet.
A vulnerability in the web framework of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation of HTTP parameters supplied by the user.
A vulnerability in the Layer 2 Tunneling Protocol (L2TP) parsing function of Cisco IOS and Cisco IOS XE could allow an unauthenticated, remote attacker to cause an affected device to reload. The issue is due to insufficient validation of L2TP packets.
A vulnerability in the web user interface of Cisco IOS XE 3.1 through 3.17 could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to insufficient resource handling by the affected software when the web user interface is under a high load.
A vulnerability in the Data-in-Motion (DMo) process installed with the Cisco IOx application environment could allow an unauthenticated, remote attacker to cause a stack overflow that could allow remote code execution with root privileges in the virtual instance running on an affected device.
A vulnerability in the Cisco application-hosting framework (CAF) component of the Cisco IOx application environment allows an authenticated, remote attacker to write or modify arbitrary files in the virtual instance running on the affected device. The vulnerability is due to insufficient input validation of user-supplied application packages.
A Directory Traversal vulnerability in the web framework code of the Cisco IOx application-hosting framework allows an unauthenticated remote attacker to read any file from the CAF in the virtual instance running on the affected device. The issue is due to insufficient input validation.
pngdefry through March 22, 2017 is prone to a heap-based buffer-overflow vulnerability because it fails to properly process a specially crafted png file. This issue affects the 'process()' function of the 'pngdefry.c' source file.
Disk Sorter Enterprise versions 9.5.12 and earlier have a buffer overflow vulnerability that allows remote attackers to execute arbitrary code via a GET request.
GNU linker (ld) w GNU Binutils 2.28 zawiera podatność na przepełnienie bufora sterty podczas przetwarzania nieprawidłowego skryptu wejściowego, co prowadzi do awarii programu. Problem wynika z braku znaku końca '\0' w polu nazwy w pliku ldlex.l.
The pe_ILF_object_p function in the Binary File Descriptor (BFD) library in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read of size 4049 because it uses the strlen function instead of strnlen. This can lead to crashes in programs such as addr2line, size, and strings, as well as information disclosure.
The find_nearest_line function in addr2line in GNU Binutils 2.28 does not handle the case where both the main file name and the directory name are empty, leading to a NULL pointer dereference and an invalid write, resulting in a program crash.
GNU assembler in GNU Binutils 2.28 is vulnerable to a global buffer overflow (of size 1) while attempting to unget an EOF character from the input stream, potentially leading to a program crash.
AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow remote authenticated users to execute arbitrary commands in a privileged context or launch a reverse shell via vectors involving the PHP session ID and the NfSen PHP code.
AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow local users to execute arbitrary commands in a privileged context via an NfSen socket.
The magick/colormap-private.h file in ImageMagick 6.8.9-9 contains a vulnerability that allows remote attackers to cause a denial of service through out-of-bounds access.
Heap overflow in ImageMagick 6.8.9-9 via a crafted wpf file.
Heap overflow in ImageMagick 6.8.9-9 via a crafted pict file.
Heap overflow in ImageMagick 6.8.9-9 via a crafted psd file.
Heap overflow in ImageMagick 6.8.9-9 via a crafted pcx file.