CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The xfrm_replay_verify_len function in the Linux kernel through version 4.10.6 does not validate certain size data after an XFRM_MSG_NEWAE update, allowing local users to obtain root privileges or cause a denial of service through heap-based out-of-bounds access.
A CSRF vulnerability was discovered in the web UI of Deluge before version 1.3.14. The exploitation methodology involves hosting a crafted plugin that executes an arbitrary program from its __init__.py file and causing the victim to download, install, and enable this plugin.
Suricata before version 3.2.1 has an IPv4 defragmentation evasion issue caused by lack of a check for the IP protocol during fragment matching.
An issue was discovered in Erlang/OTP 18.x related to the generation of compiled regular expressions, which is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset used as an array index.
The user-account creation feature in Chef Manage versions 2.1.0 through 2.4.4 allows remote attackers to execute arbitrary code. This issue is fixed in version 2.4.5.
Podatność w protokole zarządzania klastrem Cisco (CMP) w oprogramowaniu Cisco IOS i Cisco IOS XE może umożliwić nieautoryzowanemu, zdalnemu atakującemu spowodowanie ponownego uruchomienia urządzenia lub zdalne wykonanie kodu z podwyższonymi uprawnieniami. Problem wynika z niewłaściwego przetwarzania opcji Telnet specyficznych dla CMP oraz braku ograniczeń w ich użyciu tylko do lokalnych komunikacji między członkami klastra.
Buffer overflow in Cerberus FTP Server 8.0.10.3 allows remote attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a long MLST command.
qdPM 8.3 has an unrestricted file upload vulnerability that allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
A vulnerability in qdPM 8.3 allows remote attackers to obtain sensitive information via a direct request to specific configuration and log files.
The vulnerability in coders/tiff.c in ImageMagick allows remote attackers to cause application crashes through manipulation related to image identification.
The distribute-cache.c file in ImageMagick has an issue with re-using objects after they have been destroyed, which may allow remote attackers to cause unspecified impact.
GetSimple CMS version 3.3.4 allows remote attackers to obtain sensitive information via direct requests to specific XML files.
Pluck CMS version 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature.
Wonder CMS 2014 has a PHP remote file inclusion vulnerability in editInplace.php that allows remote attackers to execute arbitrary PHP code via a URL in the hook parameter.
Directory traversal vulnerability in index.php in Wonder CMS 2014 allows remote attackers to include and execute arbitrary local files via a crafted theme.
Wonder CMS 2014 allows remote attackers to obtain sensitive information by viewing /files/password, which reveals the unsalted MD5 hashed password.
readelf in GNU Binutils 2.28 is vulnerable to heap-based buffer over-reads while processing corrupt RL78 binaries. This vulnerability can lead to program crashes and may also result in information leaks.
xrdp version 0.9.1 calls the PAM function auth_start_session() in an incorrect location, leading to improper initialization of PAM session modules. This may result in incorrect configurations or elevation of privileges.
An issue was discovered in apng2gif 1.7 related to an integer overflow leading to a heap-based buffer overflow. This is associated with the read_chunk function making an unchecked addition of 12.
An issue was discovered in apng2gif 1.7 related to an integer overflow, resulting in a heap-based buffer over-read. This issue is associated with the load_apng function and the imagesize variable.