CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The dump_block function in print_sections.c in libdwarf before version 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via crafted frame data.
A programming error was discovered in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine, which may result in denial of service due to an infinite loop. This issue arises from backporting the CVE-2016-6816 fix without including the fix for Tomcat bug 57544.
In Wireshark version 2.2.4 and earlier, a crafted or malformed STANAG 4607 capture file can cause an infinite loop and memory exhaustion. If the packet size field in a packet header is null, the offset to read from will not advance, leading to continuous attempts to read the same zero length packet.
An issue was discovered in dotCMS through 3.6.1 related to the findChildrenByFilter() function, which performs string interpolation and direct SQL query execution. Although SQL quote escaping and a keyword blacklist were implemented, they can be bypassed for the q and inode parameters, leading to potential SQL injection attacks.
A heap buffer overflow in V8 in Google Chrome prior to version 56.0.2924.76 for Linux, Windows, and Mac, and prior to version 56.0.2924.87 for Android, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
WebRTC in Google Chrome prior to version 56.0.2924.76 for Linux, Windows, and Mac, and 56.0.2924.87 for Android, failed to perform proper bounds checking, allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Versions of GNU ed before 1.14.1 contain a vulnerability that allows attackers to cause a denial of service (crash) by sending a malformed command, leading to an invalid free.
A heap-based buffer overflow in the parseSWF_RGBA function in parser.c in the listswf tool in libming 0.4.7 allows remote attackers to exploit it via a crafted SWF file.
A heap-based buffer overflow in the parseSWF_DEFINEFONT function in parser.c in the listswf tool in libming 0.4.7 allows remote attackers to exploit this vulnerability via a crafted SWF file.
The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and simplesamlphp/saml2 library before 1.9.1, 1.10.x before 1.10.3, and 2.x before 2.3.3 allows remote attackers to spoof SAML responses or possibly cause a denial of service (memory consumption) by leveraging improper conversion of return values to boolean.
The ioport_read and ioport_write functions in Xen may allow local x86 HVM guest OS administrators to gain qemu process privileges via out-of-range ioport access.
The (1) order and (2) group methods in Zend_Db_Select in Zend Framework before version 1.12.19 may allow remote attackers to conduct SQL injection attacks via vectors related to the use of the character pattern [\w]* in a regular expression.
A memory leak in the __res_vinit function in the IPv6 name server management code in GNU C Library (glibc) before version 2.24 allows remote attackers to cause a denial of service by leveraging partial initialization of internal resolver data structures.
The (1) order and (2) group methods in Zend_Db_Select in Zend Framework before version 1.12.20 may allow remote attackers to conduct SQL injection attacks due to failure to remove comments from an SQL statement before validation.
The XXE vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated users with access to XACML features to read arbitrary files, cause denial of service, conduct SSRF attacks, or have unspecified other impacts via a crafted XACML request.
CVE-2016-4311 is a CSRF vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 that allows remote attackers to hijack the authentication of privileged users for requests processing XACML requests.
Zabbix before 2.2.14 and 3.0 before 3.0.4 has an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.
IBM Security Access Manager for Web versions 7.0.0, 8.0.0, and 9.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
The compile_bracket_matchingpath function in pcre_jit_compile.c in PCRE through 8.x before revision 1680 (e.g., the PHP 7.1.1 bundled version) allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted regular expression.
All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where the size of an input buffer is not validated. This can lead to denial of service or potential escalation of privileges.