CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An issue was discovered in certain Apple products, including macOS before 10.12.1, involving the 'AppleGraphicsControl' component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
An issue was discovered in certain Apple products related to the 'FontParser' component. Affects iOS before 10.1, macOS before 10.12.1, tvOS before 10.0.1, and watchOS before 3.1. This issue allows remote attackers to obtain sensitive information or cause a denial of service via a crafted font.
An issue was discovered in certain Apple products, including macOS before 10.12, involving a sandbox escape related to launchctl process spawning in the 'libxpc' component.
The dccp_rcv_state_process function in the Linux kernel through version 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures in the LISTEN state, allowing local users to obtain root privileges or cause a denial of service (double free) via an application making an IPV6_RECVPKTINFO setsockopt system call.
A race condition in the Linux kernel before version 4.9.7 in kernel/events/core.c allows local users to gain privileges via a crafted application making concurrent perf_event_open system calls to move a software group into a hardware context.
SQL injection vulnerability in GeniXCMS through version 1.0.2 allows remote authenticated users to execute arbitrary SQL commands via the 'order' parameter.
The XXE vulnerability in eParakstitajs 3 before version 1.3.9 and eParaksts Java lib before version 2.5.13 allows remote attackers to read arbitrary files or possibly have unspecified other impact via a crafted edoc file.
In Facebook's HHVM versions before 3.15.0, there is an infinite recursion in wddx, allowing attackers to have unspecified impact via unknown vectors.
The array_*_recursive functions in Facebook HHVM before version 3.15.0 allow attackers to have unspecified impact via unknown vectors, related to recursion.
Facebook HHVM versions before 3.15.0 have a self recursion issue that allows attackers to have unspecified impact via unknown vectors.
Integer overflow in StringUtil::implode in Facebook HHVM before version 3.15.0 allows attackers to have unspecified impact via unknown vectors.
Integer overflow in bcmath in Facebook HHVM before version 3.15.0 allows attackers to have unspecified impact via unknown vectors, which triggers a buffer overflow.
Facebook HHVM versions before 3.15.0 contain an out-of-bounds write vulnerability in the mb_detect_encoding, mb_send_mail, and mb_detect_order functions. Attackers can exploit this vulnerability, leading to unspecified impact.
Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.
The WRITE_UNALIGNED function in dwarf_elf_access.c in libdwarf before version 20160923 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a crafted DWARF section.
The dwarf_dealloc function in libdwarf before version 20160923 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted DWARF section.
The dwarf_get_aranges_list function in libdwarf before version 20160923 allows remote attackers to cause a denial of service (infinite loop and crash) via a crafted DWARF section.
libdwarf before version 20160923 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a large length value in a compilation unit header.
The get_attr_value function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted object with all-bits on.
The dwarf_get_macro_startend_file function in libdwarf before version 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted string offset for .debug_str.