CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In Google Chrome before version 53.0.2785.89 on Windows and OS X and before version 53.0.2785.92 on Linux, there is an issue in event processing that may lead to a denial of service (use-after-free) or other unspecified impacts.
Multiple heap-based buffer overflows in PDFium, used in Google Chrome before version 53.0.2785.89 on Windows and OS X and before version 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted JBig2 image.
The Web Animations implementation in Blink, used in Google Chrome before version 53.0.2785.89 on Windows and OS X and before version 53.0.2785.92 on Linux, improperly relies on list iteration. This may allow remote attackers to cause a denial of service (use-after-destruction) or possibly have unspecified other impact via a crafted website.
Integer overflow in the opj_tcd_get_decoded_tile_size function in OpenJPEG, used in PDFium in Google Chrome, may lead to denial of service or other unspecified impacts via crafted JPEG 2000 data.
PDFium in Google Chrome before version 53.0.2785.89 on Windows and OS X and before version 53.0.2785.92 on Linux mishandles timers, allowing remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted PDF document.
In Blink, used in Google Chrome before version 53.0.2785.89 on Windows and OS X and before version 53.0.2785.92 on Linux, there is an issue with the Indexed Database (IndexedDB) API implementation that does not properly restrict key-path evaluation. This can lead to denial of service (use-after-free) or other unspecified impacts via crafted JavaScript code.
The extensions subsystem in Google Chrome before version 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux relies on an IFRAME source URL to identify an associated extension. This allows remote attackers to conduct extension-bindings injection attacks by leveraging script access to a resource that initially has the about:blank URL.
The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a rebuild of the user profile form.
Fortinet FortiSwitch models in FortiLink managed mode, when upgraded to version 3.4.1, may allow remote attackers to bypass authentication and gain administrative access via an empty password for the rest_admin account.
J-Web in Juniper Junos OS before versions 12.1X46-D45, 12.1X46-D50, 12.1X47 before 12.1X47-D35, 12.3 before 12.3R12, 12.3X48 before 12.3X48-D25, 13.3 before 13.3R10, 13.3R9 before 13.3R9-S1, 14.1 before 14.1R7, 14.1X53 before 14.1X53-D35, 14.2 before 14.2R6, 15.1 before 15.1A2 or 15.1F4, 15.1X49 before 15.1X49-D30, and 15.1R before 15.1R3 might allow remote attackers to obtain sensitive information and consequently gain administrative privileges.
Junos OS versions before 12.1X46-D45, 12.1X46-D50, 12.1X47 before 12.1X47-D35, 12.3X48 before 12.3X48-D30, 13.3 before 13.3R9-S1, 14.1 before 14.1R7, 14.2 before 14.2R6, 15.1 before 15.1F2-S5, 15.1F4 before 15.1F4-S2, 15.1R before 15.1R2-S3, 15.1 before 15.1R3, and 15.1X49 before 15.1X49-D40 allow remote attackers to cause a denial of service (kernel crash) via a crafted UDP packet destined to the interface IP address of a 64-bit OS device.
Multiple unspecified vulnerabilities in HPE Integrated Lights-Out 3 (iLO 3) firmware before 1.88, Integrated Lights-Out 4 (iLO 4) firmware before 2.44, and Integrated Lights-Out 4 (iLO 4) mRCA firmware before 2.32 allow remote attackers to obtain sensitive information, modify data, or cause a denial of service.
The stringprep_utf8_nfkc_normalize function in libidn before version 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted UTF-8 data.
In libidn before version 1.33, a vulnerability may allow remote attackers to obtain sensitive memory information by reading a zero byte as input, triggering an out-of-bounds read.
The idna_to_ascii_4i function in lib/idna.c in libidn before version 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via 64 bytes of input.
The WiFi driver in Huawei Honor 6 smartphones with specific software versions allows attackers to cause a system crash or gain privileges via a crafted application.
In GNU libidn before version 1.33, a vulnerability exists that may allow remote attackers to obtain sensitive memory information by reading a zero byte as input, triggering an out-of-bounds read.
Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 allows remote attackers to execute arbitrary commands via 'special characters'. This is a different vulnerability than CVE-2016-7109.
Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 allows remote attackers to execute arbitrary commands via 'special characters'. This is a different vulnerability than CVE-2016-7110.
Huawei Unified Maintenance Audit (UMA) before version V200R001C00SPC200 SPH206 allows remote attackers to reset arbitrary user passwords, potentially affecting system data integrity.