CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An issue was discovered in the node-serialize package 0.0.4 for Node.js that allows arbitrary code execution. Untrusted data passed into the unserialize() function can be exploited by passing a JavaScript Object with an Immediately Invoked Function Expression (IIFE).
Firejail versions before 0.9.44.6 and 0.9.38.x LTS before 0.9.38.10 LTS do not comprehensively address dotfile cases, allowing local users to conduct sandbox-escape attacks via symlinks and the --private option.
Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt to prevent accessing user files with an euid of zero, allowing local users to conduct sandbox-escape attacks via symlinks and the --private option.
A vulnerability in the Start Before Logon (SBL) module of Cisco AnyConnect Secure Mobility Client Software for Windows could allow an unauthenticated, local attacker to open Internet Explorer with the privileges of the SYSTEM user. The vulnerability is due to insufficient implementation of the access controls.
A vulnerability in Common Internet Filesystem (CIFS) code in the Clientless SSL VPN functionality of Cisco ASA Software, Major Releases 9.0-9.6, could allow an authenticated, remote attacker to cause a heap overflow. An attacker could exploit this vulnerability by sending a crafted URL to the affected system.
The gst_ps_demux_parse_psm function in gst-plugins-bad in GStreamer allows remote attackers to cause a denial of service through invalid memory reads related to PSM parsing.
The gst_asf_demux_process_ext_content_desc function in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service via out-of-bounds heap read using extended content descriptors.
The gst_avi_demux_parse_ncdt function in gst-plugins-good in GStreamer before version 1.10.3 allows remote attackers to cause a denial of service via invalid memory reads, leading to crashes.
Multiple use-after-free vulnerabilities in the gst_mini_object_unref, gst_tag_list_unref, and gst_mxf_demux_update_essence_tracks functions in GStreamer before 1.10.3 allow remote attackers to cause a denial of service (crash) via vectors involving stream tags.
The gst_avi_demux_parse_ncdt function in gst-plugins-good in GStreamer before version 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving ncdt tags.
The qtdemux_parse_samples function in gst/isomp4/qtdemux.c in GStreamer before version 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving the current stts index.
The gst_riff_create_audio_caps function in gst-plugins-base in GStreamer before version 1.10.3 does not properly limit recursion, allowing remote attackers to cause a denial of service (stack overflow and crash) via nested WAVEFORMATEX.
The gst_date_time_new_from_iso8601_string function in GStreamer before version 1.10.3 allows remote attackers to cause a denial of service via a malformed datetime string, leading to an out-of-bounds heap read.
A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this vulnerability to obtain Secure Sockets Layer (SSL) session IDs from other sessions.
Insufficient verification of uploaded files allows attackers with webui administrators privileges to perform arbitrary code execution by uploading a new webui theme.
NSD before 4.1.11 allows remote DNS master servers to cause a denial of service via a zone transfer with unlimited data, leading to /tmp disk consumption and slave server crash.
Knot DNS before 2.3.0 allows remote DNS servers to cause a denial of service through a large zone transfer, leading to memory exhaustion and slave server crash.
LogInOut.php in Simple Machines Forum (SMF) 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via vectors related to variables derived from user input in a foreach loop.
The Packages.php file in Simple Machines Forum (SMF) 2.1 contains a vulnerability that allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the themechanges array parameter.
The TAP plugin in Jenkins before version 1.25 has a directory traversal vulnerability that allows remote attackers to read arbitrary files via an unspecified parameter.