CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The HDF5 library version 1.8.16 has a flaw in failing to check if the number of dimensions for an array read from the file is within the bounds of the allocated space. This can lead to a heap-based buffer overflow, potentially allowing arbitrary code execution.
The xc2028_set_config function in the Linux kernel before version 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) via vectors involving omission of the firmware name from a certain data structure.
A use-after-free vulnerability in the ffs_user_copy_worker function in the Linux kernel before version 4.5.3 allows local users to gain privileges by accessing an I/O data structure after a certain callback call.
A race condition in the get_task_ioprio function in the Linux kernel before version 4.6.6 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted ioprio_get system call.
A use-after-free vulnerability in the disk_seqf_stop function in the Linux kernel before version 4.7.1 allows local users to gain privileges by leveraging the execution of a certain stop operation even if the corresponding start operation had failed.
A race condition in the Linux kernel before version 4.4 in kernel/events/core.c allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging incorrect handling of an swevent data structure during a CPU unplug operation.
A double free vulnerability in the sg_common_write function in the Linux kernel before version 4.4 allows local users to gain privileges or cause a denial of service by detaching a device during an SG_IO ioctl call.
The __ext4_journal_stop function in the Linux kernel before version 4.3.3 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging improper access to a certain error field.
Vulnerability in Novell Open Enterprise Server (OES2015 SP1 before Scheduled Maintenance Update 10992, OES2015 before Scheduled Maintenance Update 10990, OES11 SP3 before Scheduled Maintenance Update 10991, OES11 SP2 before Scheduled Maintenance Update 10989) might allow authenticated remote attackers to perform unauthorized file access and modification.
EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) versions 7.3 and older contain a vulnerability that may expose the Avamar servers to potentially be compromised by malicious users.
Little Snitch versions 3.0 through 3.6.1 have a buffer overflow vulnerability that could be locally exploited, leading to an escalation of privileges and unauthorized ring0 access to the operating system. The buffer overflow is related to insufficient checking of parameters to the 'OSMalloc' and 'copyin' kernel API calls.
In Exponent CMS 2.4.0 patch1, untrusted input is passed into the getSearchResults method in notfoundController.php. This method uses the '$term' parameter directly in SQL, leading to a SQL injection vulnerability.
SQL injection vulnerability in the 'Site Browser > HTML pages' screen in dotCMS before version 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.
In dotCMS before version 3.3.1, there is an SQL injection vulnerability in the 'Content Types > Content Types' screen that allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.
In dotCMS before version 3.3.1, there is an SQL injection vulnerability in the 'Site Browser > Links pages' screen. This allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.
CVE-2016-8905 is an SQL injection vulnerability in the JSONTags servlet in dotCMS before version 3.3.1 that allows remote authenticated attackers to execute arbitrary SQL commands via the sort parameter.
In dotCMS before version 3.3.1, there is an SQL injection vulnerability in the 'Site Browser > Containers pages' screen. This allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.
In dotCMS before version 3.3.1, there is an SQL injection vulnerability in the 'Site Browser > Templates pages' screen that allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.
SQL injection vulnerability in the categoriesServlet servlet in dotCMS before 3.3.1 allows remote not authenticated attackers to execute arbitrary SQL commands via the sort parameter.
A null pointer dereference bug affects version 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in the function CInArchive::ReadAndDecodePackedStreams leads to crashes and denial of service when decoding malformed 7z files.