CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The NTP implementation in Cisco IOS 15.1 and 15.5 and IOS XE 3.2 through 3.17 allows remote attackers to modify the system time via crafted packets.
Multiple cross-site request forgery (CSRF) vulnerabilities in administrative pages in EMC ViPR SRM before version 3.7 allow remote attackers to hijack the authentication of administrators.
Use-after-free vulnerability in OptiPNG 0.6.4 allows remote attackers to execute arbitrary code via a crafted PNG file.
Buffer overflow in tibemsd in the server in TIBCO Enterprise Message Service (EMS) before version 8.3.0 and EMS Appliance before version 2.4.0 allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via crafted inbound data.
In 389 Directory Server (formerly Fedora Directory Server) versions 1.3.4.x before 1.3.4.7, a vulnerability allows remote attackers to cause a denial of service through an abnormally closed connection, leading to an infinite loop and connection blocking.
A stack-based buffer overflow in the catopen function in the GNU C Library (glibc) before version 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long catalog name.
Integer overflow in the GNU C Library (glibc or libc6) before version 2.23 allows context-dependent attackers to cause application crashes or potentially execute arbitrary code via the size argument to the __hcreate_r function, leading to out-of-bounds heap-memory access.
The strftime function in the GNU C Library (glibc) before version 2.23 allows context-dependent attackers to cause application crashes or possibly obtain sensitive information via an out-of-range time value.
Buffer overflow in the main_get_appheader function in xdelta3-main.h in xdelta3 before 3.0.9 allows remote attackers to execute arbitrary code via a crafted input file.
Multiple stack-based buffer overflows in the GNU C Library (glibc) before version 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the nan, nanf, or nanl function.
SQL injection vulnerability in the Workflow Screen in dotCMS before version 3.3.2 allows remote administrators to execute arbitrary SQL commands via the orderby parameter.
Integer overflow in the x86 shadow pagetable code in Xen allows local guest OS users to cause a denial of service (host crash) or possibly gain privileges by shadowing a superpage mapping.
Panda Endpoint Administration Agent before version 7.50.00 uses a weak ACL for the Panda Security/WaAgent directory and sub-directories, allowing local users to gain SYSTEM privileges by modifying an executable module.
Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the 'Panda Security URL Filtering' directory and installed files, allowing local users to gain SYSTEM privileges by modifying Panda_URL_Filteringb.exe.
Libreswan version 3.16 may allow remote attackers to cause a denial of service (daemon restart) via an IKEv2 aes_xcbc transform.
CVE-2015-8106 is a format string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before version 2.3.10, allowing remote attackers to execute arbitrary code via format string specifiers in the \keywords command in a crafted TeX file.
Heap-based buffer overflow in the gdk_pixbuf_flip function in gdk-pixbuf-scale.c in gdk-pixbuf 2.30.x allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted BMP file.
Multiple unspecified vulnerabilities in Google Chrome before version 50.0.2661.75 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
The download implementation in Google Chrome before version 50.0.2661.75 on Android allows remote attackers to bypass intended pathname restrictions via unspecified vectors.
Google Chrome before 50.0.2661.75 does not properly consider that frame removal may occur during callback execution, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted extension.