CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple heap-based buffer overflows in VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows, when Cortado ThinPrint virtual printing is enabled, allow guest OS users to execute arbitrary code on the host OS via unspecified vectors.
The graphic acceleration functions in VMware Tools 9.x and 10.x before 10.0.9 on OS X allow local users to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors.
The graphic acceleration functions in VMware Tools 9.x and 10.x before 10.0.9 on OS X allow local users to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors.
HP ThinPro versions 4.4 through 6.1 mishandle the keyboard layout control panel and virtual keyboard application, allowing local users to bypass intended access restrictions and gain privileges.
A race condition in the netlink_dump function in the Linux kernel before version 4.6.3 allows local users to cause a denial of service (double free) or possibly have unspecified other impact via a crafted application that makes sendmsg system calls, leading to an unexpected free operation.
A race condition in the snd_pcm_period_elapsed function in the ALSA subsystem in Linux kernel versions before 4.7 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted SNDRV_PCM_TRIGGER_START command.
The sock_setsockopt function in the Linux kernel before version 4.8.14 mishandles negative values of sk_sndbuf and sk_rcvbuf. This can lead to system crashes or memory corruption by local users leveraging the CAP_NET_ADMIN capability.
KVM in the Linux kernel before version 4.8.12 does not properly restrict the VCPU index when I/O APIC is enabled. This allows guest OS users to gain host OS privileges or cause a denial of service through a crafted interrupt request.
The netfilter subsystem in the Linux kernel before 4.9 mishandles IPv6 reassembly, allowing local users to cause denial of service through integer overflow, out-of-bounds write, and GPF. It may also lead to unspecified other impacts.
The blk_rq_map_user_iov function in the Linux kernel before version 4.8.14 does not properly restrict the type of iterator, allowing local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device.
The Linux kernel before version 4.0 has a lock mismanagement issue in the performance subsystem during certain migrations, allowing local users to gain privileges via a crafted application.
The Linux kernel before version 4.0 has a lock mismanagement issue in the performance subsystem during certain migrations, allowing local users to gain privileges via a crafted application.
The sock_setsockopt function in the Linux kernel before version 3.5 mishandles negative values of sk_sndbuf and sk_rcvbuf. This allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact.
WampServer 3.0.6 installs services 'wampapache' and 'wampmysqld' with weak file permissions, running with SYSTEM privileges. This could allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges.
A vulnerability in the Docker Engine configuration of Cisco CloudCenter Orchestrator (CCO) could allow an unauthenticated, remote attacker to install Docker containers with high privileges on the affected system.
A vulnerability in Cisco Intercloud Fabric for Business and Cisco Intercloud Fabric for Providers could allow an unauthenticated, remote attacker to connect to the database used by these products.
An issue was discovered in SPRECON-E Service Program before version 3.43 SP0 that allows non-admin users to execute telegram simulation under certain conditions. This requires prior creation of an online connection and authentication as an administrator.
In MODX Revolution before version 2.5.2-pl, there is a directory traversal vulnerability in /connectors/index.php that allows remote attackers to manipulate local files via a crafted dir parameter.
In MODX Revolution before version 2.5.2-pl, there is a directory traversal vulnerability in /connectors/index.php that allows remote attackers to manipulate local files via a crafted dir parameter.
In MODX Revolution before version 2.5.2-pl, there is a directory traversal vulnerability in /connectors/index.php that allows remote attackers to manipulate local files via a crafted id (also known as dir) parameter.