CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The rds_inc_info_copy function in the Linux kernel through version 4.6.3 does not initialize a certain structure member, allowing remote attackers to obtain sensitive information from kernel stack memory by reading an RDS message.
In the Linux kernel up to version 4.6.3, there is a flaw in handling the APICv on/off state, allowing guest OS users to gain direct APIC MSR access on the host OS. This can lead to host OS crashes or potentially executing arbitrary code on the host OS.
Siemens SIMATIC S7-300 CPU devices with Profinet support and those without Profinet support, running firmware before versions 3.2.12 and 3.3.12, allow remote attackers to cause a denial of service via crafted ISO-TSAP or Profibus packets.
The msr_mtrr_valid function in the Linux kernel before version 4.6.1 allows guest OS users to read or write to the kvm_arch_vcpu data structure, potentially leading to sensitive information disclosure or system crashes.
The icmp_check_sysrq function in the Linux kernel allows remote attackers to execute SysRq commands via crafted ICMP Echo Request packets. This can be done through a brute-force attack to discover a cookie or after reading the local icmp_echo_sysrq file.
The ecryptfs_privileged_open function in the Linux kernel before version 4.6.3 allows local users to gain privileges or cause a denial of service via crafted mmap calls for /proc pathnames, leading to recursive pagefault handling.
Integer overflow in lib/asn1_decoder.c in the Linux kernel before 4.6 allows local users to gain privileges via crafted ASN.1 data.
The snd_compress_check_input function in the ALSA subsystem in the Linux kernel before version 3.17 does not properly check for integer overflow, which may lead to denial of service due to insufficient memory allocation or other unspecified impacts.
CVE-2016-0301 involves a heap-based buffer overflow in the KeyView PDF filter in IBM Domino, allowing remote attackers to execute arbitrary code via a crafted PDF document.
A heap-based buffer overflow in the KeyView PDF filter in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6 allows remote attackers to execute arbitrary code via a crafted PDF document.
Heap-based buffer overflow in the KeyView PDF filter in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6 allows remote attackers to execute arbitrary code via a crafted PDF document.
Heap-based buffer overflow in the KeyView PDF filter in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6 allows remote attackers to execute arbitrary code via a crafted PDF document.
A Cross-site request forgery (CSRF) vulnerability exists in the PA_Theme_Creator application in IBM WebSphere Portal 8.5 CF08 through CF10 and Web Content Manager. It allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
The handle_regservice_request function in mDNSResponder before version 625.41.2 allows remote attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference) via unspecified vectors.
Multiple buffer overflows in mDNSResponder before version 625.41.2 allow remote attackers to read or write to out-of-bounds memory locations. The issues involve the GetValueForIPv4Addr, GetValueForMACAddr, rfc3110_import, and CopyNSEC3ResourceRecord functions.
Corega CG-WLBARAGM devices allow remote attackers to cause a denial of service (reboot) via unspecified vectors.
Corega CG-WLBARGL devices allow remote authenticated users to execute arbitrary commands via unspecified vectors.
Cybozu Garoon versions 3.7 through 4.2 allow remote attackers to obtain sensitive email-reading information via unspecified vectors.
Cybozu Garoon versions 3.x and 4.x before 4.2.1 allow remote authenticated users to bypass intended restrictions on reading, creating, or modifying a portlet via unspecified vectors.
A stack-based buffer overflow in Unitronics VisiLogic OPLC IDE before version 9.8.30 allows remote attackers to execute arbitrary code via a crafted filename field in a ZIP archive in a vlp file.