CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler where a NULL pointer dereference caused by invalid user input may lead to denial of service or potential escalation of privileges.
All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) where a value passed from a user to the driver is not correctly validated and used as the index to an array.
All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where a NULL pointer dereference caused by invalid user input may lead to denial of service or potential escalation of privileges.
All versions of the NVIDIA GPU and GeForce Experience installer contain a vulnerability that fails to set proper permissions on the package extraction path. This allows a non-privileged user to tamper with the extracted files, potentially leading to privilege escalation via code execution.
All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, which may lead to denial of service or potential escalation of privileges due to an attempt to access an invalid object pointer.
All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) that allows untrusted input to reference memory outside of the intended boundary of the buffer.
All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) implementation of the SubmitCommandVirtual DDI, where untrusted input is used to reference memory outside of the intended boundary of the buffer. This can lead to denial of service or escalation of privileges.
All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscapeID 0x100008b where user provided input is used as the limit for a loop. This may lead to denial of service or potential escalation of privileges.
The NVIDIA GPU Display Driver R378 contains a vulnerability in the kernel mode layer handler that may lead to improper access control.
All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where multiple integer overflows may cause improper memory allocation leading to a denial of service or potential escalation of privileges.
All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where untrusted input is used for buffer size calculation leading to denial of service or escalation of privileges.
The AcquireQuantumPixels function in ImageMagick before version 7.0.3-1 allows remote attackers to have unspecified impact via a crafted image file, triggering a memory allocation failure.
A vulnerability in the web-based GUI of Cisco UCS Director 6.0.0.0 and 6.0.0.1 allows an authenticated local attacker to execute arbitrary workflow items using just an end-user profile. The issue is due to improper role-based access control (RBAC) after Developer Mode is enabled.
The SAP Message Server HTTP daemon in SAP KERNEL 7.21-7.49 allows remote attackers to cause a denial of service (memory consumption and process crash) via multiple msgserver/group?group= requests with a crafted size of the group parameter.
Openpyxl version 2.4.1 resolves external entities by default, allowing remote attackers to conduct XXE attacks via a crafted .xlsx document.
IBM Integration Bus versions 9.0 and 10.0 and WebSphere Message Broker SOAP FLOWS are vulnerable to a denial of service due to an XML External Entity Injection (XXE) error when processing XML data.
A stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_tsfb.c in JasPer before version 1.900.30 allows remote attackers to exploit it via a crafted image.
IBM AIX versions 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the bellmail client.
The AcquireMagickMemory function in ImageMagick 7.0.3.3 before 7.0.3.8 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure.
The AcquireMagickMemory function in ImageMagick before version 7.0.3.3 allows remote attackers to have unspecified impact via a crafted image, triggering a memory allocation failure.