CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A use-after-free vulnerability in the mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via bidirectional text.
Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via a crafted image data that is mishandled during the encoding of an image frame to an image.
Use-after-free vulnerability in the nsRefreshDriver::Tick function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging improper interaction between timeline destruction and the Web Animations model implementation.
Use-after-free vulnerability in the mozilla::a11y::DocAccessible::ProcessInvalidationList function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4. It allows remote attackers to execute arbitrary code or cause a denial of service via an aria-owns attribute.
Buffer overflow in the mozilla::gfx::FilterSupport::ComputeSourceNeededRegions function in Mozilla Firefox before version 49.0 allows remote attackers to execute arbitrary code by leveraging improper interaction between empty filters and CANVAS element rendering.
A use-after-free vulnerability in the nsFrameManager::CaptureFrameState function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between restyling and the Web Animations model implementation.
The mozilla::a11y::HyperTextAccessible::GetChildOffset function in the accessibility implementation in Mozilla Firefox before version 49.0 allows remote attackers to execute arbitrary code via a crafted web site.
The nsImageGeometryMixin class in Mozilla Firefox before version 49.0, Firefox ESR 45.x before version 45.4, and Thunderbird before version 45.4 does not properly perform a cast of an unspecified variable during handling of INPUT elements, allowing remote attackers to execute arbitrary code via a crafted web site.
Heap-based buffer overflow in the nsCaseTransformTextRunFactory::TransformString function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via mishandled Unicode characters during text conversion.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before version 49.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Buffer overflow in the AAA module in Huawei USG2100, USG2200, USG5100, and USG5500 unified security gateways before V300R001C10SPC600 allows remote authenticated RADIUS servers to execute arbitrary code by sending a crafted EAP packet.
A heap-based buffer overflow in the pdf_load_mesh_params function in MuPDF can be exploited by remote attackers. Exploiting this vulnerability may lead to denial of service or arbitrary code execution via a large decode array.
The kickstart file in Red Hat QuickStart Cloud Installer (QCI) forces the use of MD5 passwords on deployed systems, making it easier for attackers to determine cleartext passwords via a brute-force attack.
Red Hat QuickStart Cloud Installer (QCI) uses world-readable permissions for the /etc/qci/answers file, allowing local users to obtain the root password for the deployed system by reading the file.
The BIOS for Lenovo ThinkCentre, ThinkServer, and ThinkStation devices may allow local users or physically proximate attackers to bypass the Secure Boot protection mechanism by leveraging an AMI test key.
The application plugins in Apache CXF Fediz versions 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to bypass intended restrictions via a crafted SAML token with a trusted signature.
A heap-based buffer overflow in the loadImage function in the tiffcrop tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service or execute arbitrary code via a crafted TIFF image with zero tiles.
A heap-based buffer overflow in the horizontalDifference8 function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier can be exploited by remote attackers. Attackers can cause a denial of service (crash) or execute arbitrary code via a crafted TIFF image to tiffcp.
Multiple integer overflows in the cvt_by_strip and cvt_by_tile functions in the tiff2rgba tool in LibTIFF 4.0.6 and earlier, when -b mode is enabled, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted TIFF image, which triggers an out-of-bounds write.