CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A double free vulnerability in the mem_close function in jas_stream.c in JasPer before version 1.900.10 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image to the imginfo command.
The read_Header function in archive_read_support_format_7zip.c in libarchive 3.2.1 allows remote attackers to cause a denial of service (out-of-bounds read) via multiple EmptyStream attributes in a header in a 7zip archive.
A stack-based buffer overflow in the safe_fprintf function in tar/util.c in libarchive 3.2.1 allows remote attackers to cause a denial of service via a crafted non-printable multibyte character in a filename.
The MagickMalloc function in GraphicsMagick 1.3.25 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure and a 'file truncation error for corrupt file.'
The ReadPCXImage function in GraphicsMagick 1.3.25 allows remote attackers to have unspecified impact via a crafted image, triggering a memory allocation failure and a file truncation error for corrupt file.
The ReadSCTImage function in GraphicsMagick 1.3.25 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted SCT header.
slock allows attackers to bypass the screen lock via vectors involving an invalid password hash, which triggers a NULL pointer dereference and crash.
IBM AIX versions 5.3, 6.1, 7.1, and 7.2 contain an unspecified vulnerability that allows a locally authenticated user to obtain root level privileges.
IBM Tivoli Storage Manager for Virtual Environments 7.1 (VMware) is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
Multiple SQL injection vulnerabilities in modified eCommerce Shopsoftware 2.0.0.0 revision 9678, when the easybill-module is not installed, allow remote attackers to execute arbitrary SQL commands via the orders_status or customers_status parameter to api/easybill/easybillcsv.php.
IBM Websphere MQ JMS client versions 7.0.1, 7.1, 7.5, 8.0, and 9.0 allow deserialization of objects from untrusted sources, which could enable a malicious user to execute arbitrary Java code by adding vulnerable classes to the classpath.
Integer overflow in the bhyve hypervisor in FreeBSD 10.1, 10.2, 10.3, and 11.0 when configured with a large amount of guest memory allows local users to gain privilege via a crafted device descriptor.
The telnetd service in FreeBSD 9.3, 10.1, 10.2, 10.3, and 11.0 allows remote attackers to inject arguments to login and bypass authentication via a sequence of memory allocation failures.
The issetugid system call in the Linux compatibility layer in FreeBSD 9.3, 10.1, and 10.2 allows local users to gain privilege via unspecified vectors.
The kernel in FreeBSD 9.3, 10.1, and 10.2 allows local users to cause a denial of service (crash) or potentially gain privilege via a crafted Linux compatibility layer setgroups system call.
The Linux compatibility layer in the kernel in FreeBSD 9.3, 10.1, and 10.2 allows local users to read portions of kernel memory and potentially gain privilege via unspecified vectors, related to 'handling of Linux futex robust lists.'
Nagios 4.3.2 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file.
A stack-based buffer overflow in the parsePresentationContext function in storescp in DICOM dcmtk-3.6.0 and earlier allows remote attackers to cause a denial of service (segmentation fault) via a long string sent to TCP port 4242.
Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (pycrypto) allows remote attackers to execute arbitrary code, as demonstrated by a crafted iv parameter to cryptmsg.py.
An issue was discovered in MuPDF before version 1912de5f08e90af1d9d0a9791f58ba3afdb9d465 related to a NULL pointer dereference in the pdf_run_xobject function during a Fitz fz_paint_pixmap_with_mask painting operation.