CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Integer overflow in Git before version 2.7.4 allows remote attackers to execute arbitrary code via (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.
In git versions before 2.7.4, there is a bug in revision.c that uses an incorrect integer data type. This allows remote attackers to execute arbitrary code via (1) long filenames or (2) many nested trees, leading to a heap-based buffer overflow.
Multiple cross-site request forgery (CSRF) vulnerabilities in the Mail interface in Zimbra Collaboration Server (ZCS) before 8.5 allow remote attackers to hijack the authentication of arbitrary users for requests that change account preferences via a SOAP request to service/soap/BatchRequest.
The XML Data Archiving Service (XML DAS) in SAP NetWeaver AS Java does not check authorization, allowing remote authenticated users to access sensitive information and gain privileges.
Podatność na przejście do katalogu w SAP NetWeaver AS Java w wersjach od 7.1 do 7.5 umożliwia zdalnym atakującym odczyt dowolnych plików poprzez wykorzystanie sekwencji ..\ w parametrze fileName w CrashFileDownloadServlet.
Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.
A stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY before 0.66.6.3 allows remote servers to cause a denial of service or execute arbitrary code via a crafted SCP-SINK file-size response to an SCP download request.
Action Pack in Ruby on Rails before version 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
Exim versions before 4.86.2, when installed setuid root, allow local users to gain privileges via the perl_startup argument.
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.
Jenkins before version 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, making it easier for remote attackers to bypass the CSRF protection mechanism via a brute-force approach.
The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by opening a JRMP listener.
The HTTP header parsing code in Node.js in versions 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header.
Node.js versions 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 are vulnerable to HTTP request smuggling attacks via a crafted Content-Length HTTP header.
Multiple buffer overflows in the XML Parser library in Apache Xerces-C before version 3.1.3 allow remote attackers to cause a denial of service (segmentation fault or memory corruption) or possibly execute arbitrary code via a crafted document.
BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data.
The ovisp driver in Huawei P8 and Mate S smartphones with specific software versions contains a vulnerability that allows attackers to cause a system crash or gain privileges via a malicious application with camera permissions.
The graphics driver in Huawei P8 and Mate S smartphones with specific software versions allows attackers to cause a system crash or gain privileges via a crafted application with graphics permissions.
There is a heap-based buffer overflow in the HIFI driver in Huawei P8 and Mate S smartphones, which can lead to system crashes or unauthorized privilege escalation via a crafted application.
There is a heap-based buffer overflow in the HIFI driver in Huawei P8 and Mate S smartphones, which can lead to system crashes or unauthorized privilege escalation via a crafted application.