CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite allows unauthenticated attackers with network access via HTTP to compromise the system. Attackers can create, delete, or modify critical data.
A vulnerability in the Oracle FLEXCUBE Investor Servicing component allows a low privileged attacker with network access via HTTP to compromise the system. The attacker can unauthorizedly create, delete, or modify critical data and gain access to all data accessible in Oracle FLEXCUBE Investor Servicing.
Vulnerability in the Oracle FLEXCUBE Private Banking component allows an unauthenticated attacker with network access via HTTP to compromise the system. It requires interaction from a third party, which may lead to unauthorized access to critical data.
A vulnerability in the Oracle FLEXCUBE Universal Banking component allows unauthenticated attackers with HTTP network access to compromise the system. Attackers can gain unauthorized access to data and modify it.
A vulnerability in the Oracle FLEXCUBE Private Banking component allows a low privileged attacker with network access via HTTP to compromise the system. Successful attacks can lead to unauthorized creation, deletion, or modification of critical data.
A vulnerability in the Oracle FLEXCUBE Universal Banking component allows low privileged attackers with network access via HTTP to compromise the system. Attackers can unauthorizedly create, delete, or modify critical data.
An integer signedness error in the memset function in uClibc and uClibc-ng before version 1.0.16 can lead to system crashes. Attackers can exploit this vulnerability by passing a negative length value.
The icaltime_from_string function in libical versions 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted string to the icalparser_parse_string function.
The parser_get_next_char function in libical versions 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) by crafting a string to the icalparser_parse_string function.
Vulnerability in the MySQL Enterprise Monitor component of Oracle MySQL allows a high privileged attacker with network access via TLS to compromise MySQL Enterprise Monitor. Affected versions are 3.1.3.7856 and earlier.
Vulnerability in the Java SE, Java SE Embedded, and JRockit components allows unauthenticated attackers with network access to compromise these systems. Attackers can gain access to critical data, leading to unauthorized creation, deletion, or modification.
Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware allows an unauthenticated attacker with network access to compromise the server. Attacks may significantly impact additional products, potentially resulting in takeover of the Oracle GlassFish Server.
Huawei Oceanstor 5800 before version V300R002C10SPC100 is vulnerable to a denial of service attack that can lead to high CPU consumption. Attackers can exploit a large number of crafted HTTP packets to disrupt the system's operation.
The t2p_readwrite_pdf_image_tile function in LibTIFF allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a JPEG file with a TIFFTAG_JPEGTABLES of length one.
The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by setting the tags TIFF_SETGET_C16ASCII or TIFF_SETGET_C32_ASCII to values that access 0-byte arrays.
A buffer overflow vulnerability exists while processing QMI QOS TLVs in Android. It affects versions that include the qmi_qos_srvc.c file.
Incorrect HTTP Request header comparison in Squid HTTP Proxy versions 3.5.0.1 through 3.5.22 and 4.0.1 through 4.0.16 results in the Collapsed Forwarding feature mistakenly identifying some private responses as suitable for delivery to multiple clients.
Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy leads to client-specific Cookie data being leaked to other clients.
An issue was discovered in eClinicalWorks healow@work 8.0 build 8 related to a blind SQL injection in EmployeePortalServlet. It can be exploited by unauthenticated users via an HTTP POST request, allowing database data to be dumped to a malicious server.
An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause a stack-based buffer overflow, resulting in remote code execution.