CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote HTTP servers to cause a denial of service or execute arbitrary code via crafted Edge Side Includes (ESI) responses.
Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9 might allow remote attackers to cause a denial of service or execute arbitrary code by seeding manager reports with crafted data.
Varnish 3.x before 3.0.7, when used in certain stacked installations, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a header line terminated by a (carriage return) character in conjunction with multiple Content-Length headers in an HTTP request.
Samba versions 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 do not verify X.509 certificates from TLS servers, allowing man-in-the-middle attackers to spoof LDAPS and HTTPS servers and obtain sensitive information via a crafted certificate.
The management console on Symantec Messaging Gateway (SMG) Appliance devices before version 10.6.1 allows local users to obtain root-shell access via crafted terminal-window input.
The management console on Symantec Messaging Gateway (SMG) Appliance devices before 10.6.1 allows local users to discover an encrypted AD password by leveraging certain read privileges.
Use-after-free vulnerability in the TextField object implementation in Adobe Flash Player before version 18.0.0.268 and in versions 19.x and 20.x before 20.0.0.228 on Windows and OS X, as well as before 11.2.202.554 on Linux. It allows attackers to execute arbitrary code via crafted text property.
The ConvertToPDF plugin in Foxit Reader and PhantomPDF before version 7.3.4 on Windows, when the gflags app is enabled, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted (1) JPEG, (2) GIF, or (3) BMP image.
CVE-2016-4064 is a use-after-free vulnerability in the XFA forms handling functionality in Foxit Reader and PhantomPDF before version 7.3.4 on Windows. It allows remote attackers to execute arbitrary code via a crafted remerge call.
Use-after-free vulnerability in Foxit Reader and PhantomPDF before version 7.3.4 on Windows allows remote attackers to execute arbitrary code via an object with a revision number of -1 in a PDF document.
Foxit Reader and PhantomPDF before version 7.3.4 on Windows allow remote attackers to cause application crashes via a crafted content stream.
A use-after-free vulnerability in Foxit Reader and PhantomPDF before version 7.3.4 on Windows can lead to application crashes.
A use-after-free vulnerability in Foxit Reader and PhantomPDF before version 7.3.4 on Windows allows remote attackers to execute arbitrary code via a crafted FlateDecode stream in a PDF document.
CVE-2016-1593 describes a directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before version 7.2, allowing remote authenticated administrators to upload and execute arbitrary JSP files by using .. (dot dot) in a filename within a multipart/form-data POST request.
The Bluetooth functionality in Lemur Vehicle Monitors BlueDriver before 2016-04-07 supports unrestricted pairing without a PIN, allowing remote attackers to send arbitrary CAN commands.
The HMI web server in Ecava IntegraXor before version 5.0 build 4522 allows remote attackers to obtain sensitive cleartext information by sniffing the network.
CVE-2016-2299 is an SQL injection vulnerability in Ecava IntegraXor before version 5.0 build 4522 that allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
The fill_xrgb32_lerp_opaque_spans function in cairo-image-compositor.c in cairo before 1.14.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a negative span length.
Unspecified vulnerability in the Oracle Field Service component in Oracle E-Business Suite 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Wireless.
Unspecified vulnerability in the MySQL Enterprise Monitor component in Oracle MySQL 3.0.25 and earlier and 3.1.2 and earlier allows remote administrators to affect confidentiality, integrity, and availability via vectors related to Monitoring: Server.