CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause a stack-based buffer overflow, resulting in remote code execution.
An out-of-bounds read vulnerability exists in Aerospike Database Server 3.10.0.3 that can be exploited by an attacker to disclose memory within the process. A specially crafted packet can also trigger a denial of service.
A heap write out of bounds vulnerability exists in the decoding of BPG images in the Libbpg library. A crafted BPG image decoded by libbpg can cause an integer underflow vulnerability leading to out of bounds heap write and remote code execution.
Privilege escalation vulnerability in Lenovo Transition application used in Lenovo Yoga, Flex and Miix systems running Windows allows local users to execute code with elevated privileges.
CVE-2016-8225 describes an unquoted service path vulnerability in the Lenovo Edge and Lenovo Slim USB Keyboard Driver versions earlier than 1.21, allowing local users to execute code with elevated privileges.
A double free vulnerability in the gdImageWebPtr function in the GD Graphics Library (libgd) before version 2.2.4 allows remote attackers to have unspecified impact via large width and height values.
Xen through 4.8.x allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emulation.
A vulnerability in Cisco WebEx Meetings Server allows an authenticated, remote attacker to execute predetermined shell commands on other hosts.
A vulnerability in Cisco WebEx Meetings Server allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against an administrative user.
A vulnerability in Cisco Hybrid Meeting Server allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against the user of the web interface.
In Wireshark versions 2.2.0 to 2.2.3 and 2.0.0 to 2.0.9, the DHCPv6 dissector could enter a large loop triggered by packet injection or a malformed capture file. This was addressed by changing a data type to avoid an integer overflow.
In Wireshark versions 2.2.0 to 2.2.3 and 2.0.0 to 2.0.9, the ASTERIX dissector could enter an infinite loop triggered by packet injection or a malformed capture file. This was addressed by changing a data type to avoid an integer overflow.
Multiple buffer overflows in Autodesk FBX-SDK before version 2017.1 can allow attackers to execute arbitrary code when reading or converting malformed 3DS format files.
Multiple buffer overflows in Autodesk FBX-SDK before version 2017.1 can allow attackers to execute arbitrary code when reading or converting malformed DAE format files.
Improper handling in the Autodesk FBX-SDK before version 2017.1 regarding type mismatches and previously deleted objects related to reading and converting malformed FBX format files can allow attackers to gain access to uninitialized pointers.
Multiple buffer overflows in Autodesk FBX-SDK before version 2017.1 can allow attackers to execute arbitrary code when reading or converting malformed DFX format files.
Multiple buffer overflows in Autodesk FBX-SDK before version 2017.1 can allow attackers to execute arbitrary code or cause an infinite loop condition when reading or converting malformed FBX format files.
An issue was discovered in Pagekit CMS before 1.0.11 that allows a remote attacker to reset a registered user's password when the debug toolbar is enabled. The password can be successfully recovered using this exploit.
The php_wddx_pop_element function in PHP 7.0.x before 7.0.15 and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service via a NULL pointer dereference, leading to application crash.
The object_common1 function in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) via crafted serialized data that is mishandled in a finish_nested_data call.