CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The overlayfs implementation in the Linux kernel through version 4.5.2 does not properly maintain POSIX ACL xattr data, allowing local users to gain privileges by leveraging a group-writable setgid directory.
Integer overflow in the aio_setup_single_vector function in Linux kernel 4.0 allows local users to cause denial of service or possibly have unspecified other impact via a large AIO iovec.
The NFS client in the Linux kernel before version 4.2.2 has a memory initialization issue for migration recovery operations. This allows remote NFS servers to cause a denial of service via crafted network traffic.
The skb_copy_and_csum_datagram_iovec function in Linux kernel 3.14.54 and 3.18.22 does not accept a length argument, allowing local users to cause a denial of service (memory corruption) or possibly unspecified other impacts via a write system call followed by a recvmsg system call.
The Linux kernel 3.19 before 3.19.3 does not validate certain range data for sendto and recvfrom system calls, allowing local users to gain privileges by leveraging a subsystem that uses the copy_from_iter function in the iov_iter interface.
Integer overflow in fs/aio.c in the Linux kernel before 3.4.1 allows local users to cause a denial of service or possibly have unspecified other impact via a large AIO iovec.
The netlink_sendmsg function in the Linux kernel before version 3.5.5 does not validate the dst_pid field, allowing local users to spoof Netlink messages.
The redirect_target function in the Linux kernel before version 2.6.0 allows remote attackers to cause a denial of service by sending packets to an interface with a 0.0.0.0 IP address, leading to a NULL pointer dereference.
The do_setup_env function in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program.
A heap-based buffer overflow in the libstagefright library in Mozilla Firefox before version 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code via crafted CENC offsets that lead to mismanagement of the sizes table.
A race condition in the get implementation in the ServiceWorkerManager class in the Service Worker subsystem in Mozilla Firefox before version 46.0 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.
A use-after-free vulnerability in the ServiceWorkerInfo class in the Service Worker subsystem in Mozilla Firefox before version 46.0 allows remote attackers to execute arbitrary code via vectors related to the BeginReading method.
The watch implementation in the JavaScript engine in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0 and Firefox ESR 45.x before 45.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Unspecified vulnerability in the browser engine in Mozilla Firefox ESR 38.x before 38.8 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before version 46.0 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
The XML parser in Cisco Information Server (CIS) 6.2 allows remote attackers to read arbitrary files or cause a denial of service (CPU and memory consumption) via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVE-2016-1201 is a CSRF vulnerability in LOCKON EC-CUBE versions 3.0.0 through 3.0.9 that allows remote attackers to hijack the authentication of administrators.
A double free vulnerability in Adobe Reader and Acrobat allows attackers to execute arbitrary code via a crafted Graphics State dictionary. This affects versions before 11.0.14, and DC Classic before 15.006.30119 and DC Continuous before 15.010.20056 on Windows and OS X.