CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The AntiVirus Decomposer engine in various Symantec products contains a vulnerability that could lead to unauthorized access or execution of malicious code. This affects multiple software versions, including Symantec Advanced Threat Protection and Symantec Endpoint Protection.
Integer overflow in the TNEF unpacker in the AntiVirus Decomposer engine in Symantec products that may lead to unauthorized access or execution of malicious code.
The AntiVirus Decomposer engine in various Symantec products contains a vulnerability that may lead to unauthorized access or execution of malicious code. This affects multiple software versions, including Symantec Advanced Threat Protection and Symantec Endpoint Protection.
The AntiVirus Decomposer engine in various Symantec products contains a vulnerability that could lead to unauthorized access or execution of malicious code. This affects multiple software versions, including Symantec Advanced Threat Protection and Symantec Endpoint Protection.
Buffer overflow in Dec2LHA.dll in the AntiVirus Decomposer engine in various Symantec products may lead to unauthorized access or execution of malicious code. This affects multiple versions of Symantec Advanced Threat Protection, Symantec Endpoint Protection, and other products.
Buffer overflow in Dec2SS.dll in the AntiVirus Decomposer engine in various Symantec products, which may lead to unauthorized access or execution of malicious code.
The AntiVirus Decomposer engine in various Symantec products contains a vulnerability that could lead to unauthorized access or execution of malicious code. This affects versions of Symantec Advanced Threat Protection, Symantec Data Center Security, Symantec Endpoint Protection, and other products prior to specified update versions.
HAproxy 1.6.x before 1.6.6, when a deny comes from a reqdeny rule, allows remote attackers to cause a denial of service (uninitialized memory access and crash) or possibly have unspecified other impact via unknown vectors.
The parse_chunk_header function in libtorrent before version 1.1.1 allows remote attackers to cause a denial of service (crash) via a crafted HTTP response or possibly a UPnP broadcast.
F5 BIG-IP versions before 12.0.0 HF3 allow remote authenticated users to modify the account configuration of users with the Resource Administration role, potentially gaining privileges via a crafted external Extended Application Verification (EAV) monitor script.
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.
CRLF injection vulnerability in the send email functionality in dotCMS before 3.3.2 allows remote attackers to inject arbitrary email headers via CRLF sequences in the subject.
The overflow protection in Expat is removed by compilers with certain optimization settings, allowing remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data.
Version 2.6.7 of Symphony CMS contains a session fixation vulnerability when session.use_only_cookies is disabled. This allows remote attackers to hijack web sessions via the PHPSESSID parameter.
Dnsmasq before 2.76 allows remote servers to cause a denial of service (crash) via a reply with an empty DNS address that has an (1) A or (2) AAAA record defined locally.
The vulnerability in hotfix_upload.cgi in Trend Micro Deep Discovery Inspector (DDI) 3.7, 3.8 SP1, and 3.8 SP2 allows remote administrators to execute arbitrary code via shell metacharacters in the filename parameter of the Content-Disposition header.
Lenovo BIOS EFI Driver allows local administrators to execute arbitrary code with System Management Mode (SMM) privileges via unspecified vectors.
A memory leak in Huawei AR3200 before V200R007C00SPC900 can be exploited by remote attackers. Attackers can cause a denial of service by sending a large number of crafted MPLS packets.
Lenovo Solution Center (LSC) before 3.3.003 allows local users to execute arbitrary code with LocalSystem privileges. This is exploited via the StartProxy command of the LSC.Services.SystemService with a previously created named pipe and a crafted .NET assembly.
Huawei Mate8 versions before NXT-AL10C00B182, NXT-CL00C92B182, NXT-DL00C17B182, and NXT-TL00C01B182 allow attackers to bypass permission checks and delete user data via a crafted app.