CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A stack based buffer overflow vulnerability exists in the ipNameAdd functionality of Iceni Argus version 6.6.04 for Linux x64 and Windows x64. A specially crafted PDF file can cause a buffer overflow resulting in arbitrary code execution.
In version 6.6.04 of Iceni Argus, there is a stack-based buffer overflow vulnerability in the ipfSetColourStroke function. A specially crafted PDF file can cause a buffer overflow, leading to arbitrary code execution.
In version 4.0.6 of the LibTIFF library, there is a remote code execution vulnerability related to the handling of TIFF images. A crafted TIFF document can lead to a type confusion vulnerability resulting in remote code execution.
An unauthorized redirect vulnerability in Citrix NetScaler ADC before version 10.1 135.8, 10.5 61.11, 11.0 65.31/65.35F, and 11.1 47.14 allows a remote attacker to steal session cookies of a legitimate AAA user via manipulation of the Host header.
MuJS before version a5c747f1d40e8d6659a37a8d25f13fb5acf8e767 allows context-dependent attackers to obtain sensitive information by using the 'opname in crafted JavaScript file' approach. The issue is related to an 'Out-of-Bounds read' in the jsC_dumpfunction function in the jsdump.c component.
Docker Engine version 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes.
In dotCMS version 3.2.1, an attacker can load captcha once, fill it with the correct value, and then this correct value will be accepted for forms with captcha check later.
Buffer overflow in the zmq interface in csp_if_zmqhub.c in the libcsp library v1.4 and earlier allows hostile computers connected via a zmq interface to execute arbitrary code via a long packet.
Buffer overflow in the csp_sfp_recv_fp function in csp_sfp.c in the libcsp library v1.4 and earlier allows hostile components with network access to the SFP underlying network layers to execute arbitrary code via specially crafted SFP packets.
Buffer overflow in the csp_can_process_frame function in the libcsp library v1.4 and earlier allows hostile components connected to the canbus to execute arbitrary code via a long csp packet.
A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and retrieve database information or read local system files via MySQL's LOAD_FILE.
PHP object injection vulnerabilities exist in multiple widget files in AlienVault OSSIM and USM before version 5.3.2. These vulnerabilities allow arbitrary PHP code execution via magic methods in included classes.
Moodle version 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a 'SQL Injection' issue affecting the Administration panel function in the installation process.
A buffer overflow in Redis versions 3.2.x prior to 3.2.4 can lead to arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in the handling of the client-output-buffer-limit option during the CONFIG SET command.
A buffer overflow in OpenJPEG 2.1.1 can lead to arbitrary code execution when parsing a crafted image. Exploiting this vulnerability requires the user to open a malicious jpeg2000 file.
A vulnerability in the interdevice communications interface of the Cisco IP Interoperability and Collaboration System (IPICS) Universal Media Services (UMS) could allow an unauthenticated, remote attacker to modify configuration parameters of the UMS and cause the system to become unavailable.
A vulnerability in email message and content filtering in Cisco AsyncOS for Cisco Email Security Appliances (ESA) and Web Security Appliances (WSA) allows an unauthenticated, remote attacker to bypass filtering functionality. Emails that should have been quarantined could instead be processed.
A vulnerability in Advanced Malware Protection (AMP) for Cisco Email Security Appliances (ESA) and Web Security Appliances (WSA) could allow an unauthenticated, remote attacker to cause a partial denial of service (DoS) condition due to the AMP process unexpectedly restarting.
A vulnerability in local FTP to the Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause a partial denial of service (DoS) condition when the FTP application unexpectedly quits.
A vulnerability in the configured security policies, including drop email filtering, in Cisco AsyncOS for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass a configured drop filter by using an email with a corrupted attachment.