CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Heap-based buffer overflow in PCRE versions 8.34 through 8.37 and PCRE2 10.10 allows remote attackers to execute arbitrary code via a crafted regular expression.
Buffer overflow in enhance.c in ImageMagick before version 7.0.2-7 allows remote attackers to have unspecified impact via vectors related to pixel cache morphology.
Buffer overflow in the Get8BIMProperty function in ImageMagick before version 6.9.5-4 and 7.x before version 7.0.2-6 allows remote attackers to cause a denial of service via a crafted image.
In ImageMagick before version 7.0.2-1, a vulnerability allows remote attackers to obtain sensitive memory information via vectors involving the q variable, which triggers an out-of-bounds read.
Integer overflow in profile.c in ImageMagick before version 7.0.2-1 allows remote attackers to cause a denial of service (segmentation fault) or possibly execute arbitrary code via manipulation of the offset variable.
The DCM reader in ImageMagick before version 6.9.4-5 and 7.x before version 7.0.1-7 allows remote attackers to exploit the lack of validation of pixel values (red, green, blue), potentially leading to unspecified impact.
The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact via vectors involving the for statement in computing the pixel scaling table.
The DCM reader in ImageMagick before version 6.9.4-5 and 7.x before version 7.0.1-7 allows remote attackers to leverage lack of NULL pointer checks, potentially leading to unspecified impact.
The WPG parser in ImageMagick before version 6.9.4-4 and 7.x before version 7.0.1-5, when a memory limit is set, allows remote attackers to have unspecified impact via issues related to the SetImageExtent return-value check. This can lead to a heap-based buffer overflow in the SetPixelIndex function or an invalid write operation in the ScaleCharToQuantum or SetPixelIndex functions.
The VerticalFilter function in the DDS coder in ImageMagick before 6.9.4-3 and 7.x before 7.0.1-4 allows remote attackers to have unspecified impact via a crafted DDS file, which triggers an out-of-bounds read.
An issue was discovered in Asterisk Open Source versions 13.12.x, 13.13.x before 13.13.1, and 14.x before 14.2.1 related to the handling of the Opus codec. Receiving an SDP offer or answer with format parameters separated by spaces causes the code to recursively call itself, leading to a crash.
An issue was discovered in w3m before version 0.5.3-31 related to a buffer overflow in the formUpdateBuffer function. Remote attackers can cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML page.
An issue was discovered in w3m before version 0.5.3-31 related to a heap-based buffer overflow in the addMultirowsForm function. This allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML page.
Integer overflow vulnerability in bdwgc before 2016-09-27 allows attackers to cause client of bdwgc denial of service (heap buffer overflow crash) and possibly execute arbitrary code via huge allocation.
An issue was discovered in the Tatsuya Kinoshita w3m fork before version 0.5.3-31. Integer overflow vulnerability in the renderTable function in w3m allows remote attackers to cause a denial of service (OOM) and possibly execute arbitrary code via a crafted HTML page.
An issue was discovered in the w3m fork before version 0.5.3-31, involving a heap-based buffer overflow in the addMultirowsForm function. This allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML page.
An issue was discovered in w3m before version 0.5.3-31 related to improper validation of tag attribute values, which can lead to heap buffer overflow and program crashes. Remote attackers may exploit this vulnerability to potentially execute arbitrary code via a crafted HTML page.
An issue was discovered in the w3m fork before version 0.5.3-31. Heap-based buffer overflow in w3m allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML page.
An issue was discovered in w3m before version 0.5.3-31 related to the feed_table_tag function, which does not properly validate the table span value. This allows remote attackers to cause a denial of service (stack and/or heap buffer overflow) and possibly execute arbitrary code via a crafted HTML page.
An issue was discovered in phpMyAdmin related to improper stripping of the CSRF token from the return URL of the preference import action when the arg_separator is different from its default '&' value. This affects versions 4.6.x (prior to 4.6.5), 4.4.x (prior to 4.4.15.9), and 4.0.x (prior to 4.0.10.18).