CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The do_shmat function in the Linux kernel through version 4.9.12 does not restrict the address calculated by a certain rounding operation, allowing local users to map page zero. This enables bypassing a protection mechanism for the mmap system call.
An issue was discovered in tnef before 1.4.13 related to four type confusions in the file_add_mapi_attrs() function. This may lead to invalid read and write operations controlled by an attacker.
An issue was discovered in tnef before version 1.4.13 related to two type confusions in the parse_file() function. This may lead to invalid read and write operations controlled by an attacker.
An issue was discovered in tnef before version 1.4.13 related to integer overflows that can lead to heap overflows in functions handling memory allocation.
An issue was discovered in tnef before version 1.4.13 related to two OOB Write operations in the mapi_attr_read() function. These may lead to invalid read and write operations controlled by an attacker.
An issue was discovered in ytnef before version 1.9.1 related to directory traversal using the filename, associated with the SanitizeFilename function in settings.c.
An issue was discovered in ytnef before version 1.9.1 related to a patch described as '8 of 9. Out of Bounds read and write.'
An issue was discovered in ytnef before version 1.9.1 related to a patch described as '7 of 9. Out of Bounds read.'
An issue was discovered in ytnef before version 1.9.1 related to invalid write and integer overflow, which may lead to unauthorized access or data corruption.
An issue was discovered in ytnef before version 1.9.1 related to an integer overflow, described as '5 of 9'.
An issue was discovered in ytnef before version 1.9.1 related to out of bounds reads.
An issue was discovered in ytnef before 1.9.1 related to a buffer overflow in the version field in lib/tnef-types.h.
An issue was discovered in ytnef before version 1.9.1 related to null pointer dereference and unchecked return value from calloc.
Multiple use-after-free vulnerabilities in the gx_image_enum_begin function in base/gxipixel.c in Ghostscript before ecceafe3abba2714ef9b432035fe0739d9b1a283 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PostScript document.
Use-after-free vulnerability in pcsc-lite before version 1.8.20 allows remote attackers to cause denial of service (crash) via a command that uses 'cardsList' after the handle has been released through the SCardReleaseContext function.
tcpdf versions before 6.2.0 have a vulnerability that allows files from the server generating PDF files to be uploaded to an external FTP server.
The tcp_splice_read function in the Linux kernel before version 4.9.11 allows remote attackers to cause a denial of service through the use of a TCP packet with the URG flag, leading to an infinite loop and soft lockup.
IBM Rhapsody DM versions 4.0, 5.0, and 6.0 is vulnerable to a denial of service due to an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or exhaust all available memory resources.
D-Link DGS-1510-28XMP, DGS-1510-28X, DGS-1510-52X, DGS-1510-52, DGS-1510-28P, DGS-1510-28, and DGS-1510-20 Websmart devices with firmware before 1.31.B003 are vulnerable to Unauthenticated Information Disclosure attacks via unspecified vectors.
D-Link DGS-1510-28XMP, DGS-1510-28X, DGS-1510-52X, DGS-1510-52, DGS-1510-28P, DGS-1510-28, and DGS-1510-20 Websmart devices with firmware before 1.31.B003 are vulnerable to Unauthenticated Command Bypass attacks. Attackers can exploit unspecified vectors to conduct these attacks.