CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a denial of service (out-of-bounds heap memory access and application crash), or possibly have unspecified other impact via an unclosed HTML comment.
Stack-based buffer overflow in the conv_euctojis function in Claws Mail 3.13.1 allows remote attackers to have unspecified impact via a crafted email, involving Japanese character set conversion.
Multiple stack-based buffer overflows in the conv_jistoeuc, conv_euctojis, and conv_sjistoeuc functions in Claws Mail before version 3.13.1 may allow remote attackers to have unspecified impact via a crafted email, involving Japanese character set conversion.
The host_new_graphs function in graphs_new.php in Cacti 0.8.8f and earlier has an SQL injection vulnerability that allows remote authenticated users to execute arbitrary SQL commands via the cg_g parameter in a save action.
Puppet Enterprise 2015.3 before 2015.3.1 allows remote attackers to bypass a host whitelist protection mechanism by leveraging the Puppet communications protocol.
The CSV export in Apache LDAP Studio and Apache Directory Studio before version 2.0.0-M10 does not properly escape field values, which might allow attackers to execute arbitrary commands by leveraging a crafted LDAP entry that is interpreted as a formula when imported into a spreadsheet.
The TripleO Heat templates in Red Hat Enterprise Linux OpenStack Platform 7.0 do not properly use the configured RabbitMQ credentials, making it easier for remote attackers to gain access to services in deployed overclouds by leveraging knowledge of the default credentials.
The TripleO Heat templates (tripleo-heat-templates) allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter.
Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy.
The Policy Admin Tool in Apache Ranger before version 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs.
Huawei Quidway S9700, S5700, S5300, S9300, and S7700 switches with software before V200R003SPH012 are vulnerable to remote attacks that can cause a denial of service by forcing a switch restart via crafted traffic.
CVE-2016-3675 is an SQL injection vulnerability in Huawei Policy Center with software versions before V100R003C10SPC020. It allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to system databases.
SQL injection vulnerability in graph_view.php in Cacti 0.8.8.g allows remote authenticated users to execute arbitrary SQL commands via the host_group_data parameter.
The brin_page_type and brin_metapage_info functions in the pageinspect extension in PostgreSQL before version 9.5.2 allow attackers to bypass intended access restrictions. Consequently, they can obtain sensitive server memory information or cause a denial of service (server crash) via a crafted bytea value in a BRIN index page.
A heap-based buffer overflow in the SEAS module in Kamailio before version 4.3.5 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a large SIP packet.
PostgreSQL before 9.5.x before 9.5.2 does not properly maintain row-security status in cached plans, which might allow attackers to bypass intended access restrictions.
The oarsh script in OAR before version 2.5.7 allows remote authenticated users of a cluster to obtain sensitive information and possibly gain privileges via vectors related to OpenSSH options.
The decode_search function in dhcp.c in dhcpcd 3.x does not properly free allocated memory, allowing remote DHCP servers to cause a denial of service via a crafted response.
The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds read) via a crafted response.
The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds write) via a crafted response.