CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before version 2.1.6-beta allows attackers to cause a denial of service (segmentation fault) via vectors involving a long string in brackets in the ip_as_string argument.
The name_parse function in evdns.c in libevent before version 2.1.6-beta allows remote attackers to have unspecified impact via vectors involving the label_len variable, leading to an out-of-bounds stack read.
Integer overflow in gd_io.c in the GD Graphics Library (libgd) before version 2.2.4 allows remote attackers to have unspecified impact via manipulation of the number of horizontal and vertical chunks in an image.
An integer underflow in the _gdContributionsAlloc function in the GD Graphics Library (libgd) before version 2.2.4 allows remote attackers to have unspecified impact via manipulation of the u variable.
Heap-based buffer overflow in the jpc_dec_decodepkt function in jpc_t2dec.c in JasPer 2.0.10 allows remote attackers to exploit it via a crafted image.
Buffer overflow in the PoDoFo::PdfParser::ReadXRefSubsection function in PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.
A heap-based buffer overflow in the PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.4 allows remote attackers to exploit it via a crafted file.
A heap-based buffer overflow in the readValue function in FileHandle.cpp in audiofile (aka libaudiofile and Audio File Library) 0.3.6 allows remote attackers to have unspecified impact via a crafted WAV file.
A heap-based buffer overflow exists in the MSADPCM::initializeCoefficients function in audiofile (libaudiofile) version 0.3.6, allowing remote attackers to have unspecified impact via a crafted audio file.
Heap-based buffer overflow in the parse_unicode_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds write) and possibly code execution via a crafted plist file.
A cross-site request forgery (CSRF) vulnerability in NETGEAR DGN2200 routers with firmware versions 10.0.0.20 through 10.0.0.50 allows remote attackers to hijack user authentication for requests performing DNS lookups via the host_name parameter to dnslookup.cgi.
A stack-based buffer overflow in jstest_main.c in mujstest in Artifex Software, Inc. MuPDF 1.10a allows remote attackers to have unspecified impact via a crafted image.
Integer overflow in the jpc_pi_nextcprl function in jpc_t2cod.c in JasPer before 1.900.20 allows remote attackers to have unspecified impact via a crafted file, which triggers use of an uninitialized value.
The jp2_colr_destroy function in JasPer before version 1.900.13 allows remote attackers to cause a denial of service (NULL pointer dereference) by leveraging incorrect cleanup of JP2 box data on error. This vulnerability exists because of an incomplete fix for CVE-2016-8887.
Heap-based buffer overflow in the jpc_dec_tiledecode function in JasPer before version 1.900.12 can be exploited by remote attackers via a crafted image file.
The jpc_tsfb_synthesize function in jpc_tsfb.c in JasPer before version 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) via vectors involving an empty sequence.
In ioquake3 before 2017-03-14, the auto-downloading feature has insufficient content restrictions. A malicious auto-downloaded file can trigger loading of crafted files as native code DLLs.
SQL injection vulnerability in core services in Intel Security McAfee ePolicy Orchestrator (ePO) 5.3.2 and earlier and 5.1.3 and earlier allows attackers to alter a SQL query. This can result in disclosure of information within the database or impersonation of an agent without authentication via a specially crafted HTTP post.
CVE-2016-8026 describes an arbitrary command execution vulnerability in Intel Security McAfee Security Scan Plus (SSP) version 3.11.469 and earlier. It allows authenticated users to gain elevated privileges via unspecified vectors.
The vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) involves improper neutralization of CRLF sequences in HTTP headers, allowing a remote unauthenticated attacker to obtain sensitive information via server HTTP response spoofing.