CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in Hancom Office 2014 allows for exploitation of a memory allocation error when processing a Hangul HShow document (.hpt). An attacker can trigger memory corruption outside the allocated buffer, potentially leading to code execution.
CVE-2016-4291 affects Hancom Office 2014, where opening a Hangul HShow document (.hpt) can lead to an integer overflow. This results in improperly allocated memory that can cause data to be written outside the allocated buffer.
A vulnerability in Hancom Office 2014 allows for memory data overwriting, potentially leading to code execution. The issue occurs when opening Hangul HShow documents (.hpt) and is related to incorrect buffer length calculations.
A local privilege escalation vulnerability exists in BlueStacks App Player. The BlueStacks App Player installer creates a registry key with weak permissions that allows users to execute arbitrary programs with SYSTEM privileges.
A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted data sent via the server could lead to a buffer overflow, potentially resulting in memory corruption.
A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent by the server could lead to an out-of-bounds write.
A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in arbitrary code execution.
A memory corruption vulnerability exists in Pidgin's handling of the MXIT protocol. A specially crafted MXIT MultiMX message sent via the server can lead to an out-of-bounds write, resulting in memory disclosure and code execution.
An out-of-bounds write vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could cause memory corruption resulting in code execution.
Multiple memory corruption vulnerabilities exist in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could result in multiple buffer overflows, potentially resulting in code execution or memory disclosure.
CVE-2016-2339 describes a heap overflow vulnerability in the 'initialize' function of Fiddle::Function.new in Ruby. A specially crafted object passed as an element of the args array can increase the size of this array after allocation, leading to a heap overflow.
Type confusion exists in the TclTkIp class method _cancel_eval in Ruby. An attacker passing a different type of object than String as the 'retval' argument can cause arbitrary code execution.
Type confusion exists in the WIN32OLE class in Ruby in the ole_invoke and ole_query_interface methods. An attacker passing a different type of object than assumed by developers can cause arbitrary code execution.
An attacker can spoof a packet from a legitimate ntpd server, leading to the client rejecting future responses from valid servers. Clients running NTP 4.2.8p4 and earlier and NTPSec aa48d001683e5b791a743ec9c575aaf7d867a2b0c will reject responses after the mode has been changed.
A remote code execution vulnerability exists in the Trane ComfortLink II firmware version 2.0.2 in the DSS service. An attacker who can connect to the DSS service on the Trane ComfortLink II device can send an overly long REG request that can overflow a fixed size stack buffer, resulting in arbitrary code execution.
A design flaw in the Trane ComfortLink II SCC firmware version 2.0.2 allows remote attackers to take complete control of the system.
The x509FreeExtensions function in MatrixSSL before 3.8.6 allows remote attackers to cause a denial of service (free of unallocated memory) via a crafted X.509 certificate.
MatrixSSL before 3.8.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted ASN.1 Bit Field primitive in an X.509 certificate.
Heap-based buffer overflow in MatrixSSL before version 3.8.6 allows remote attackers to execute arbitrary code via a crafted Subject Alt Name in an X.509 certificate.
The Parental Control panel in Genexis devices with DRGOS before version 1.14.1 allows remote authenticated users to execute arbitrary CLI commands via the start_hour, start_minute, end_hour, end_minute, or hostname parameters.