CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
HPE ArcSight ESM versions 5.x before 5.6, 6.0, 6.5.x before 6.5C SP1 Patch 2, 6.8c before P1, and ArcSight ESM Express before 6.9.1, allows remote authenticated users to conduct unspecified 'file download' attacks via unknown vectors.
HPE ArcSight ESM versions 5.x before 5.6, 6.0, 6.5.x before 6.5C SP1 Patch 2, 6.8c before P1, and ArcSight ESM Express before 6.9.1, allows local users to gain privileges for command execution via unspecified vectors.
HPE Network Automation versions 9.22 through 9.22.02 and 10.x before 10.00.02 allow remote attackers to execute arbitrary code or obtain sensitive information via unspecified vectors.
HPE Network Automation versions 9.22 through 9.22.02 and 10.x before 10.00.02 allow remote attackers to execute arbitrary code or obtain sensitive information via unspecified vectors.
In glibc versions before 2.19-18+deb8u4 on Debian jessie and before 2.15-0ubuntu10.14 on Ubuntu 12.04 LTS, 2.19-0ubuntu6.8 on Ubuntu 14.04 LTS, 2.21-0ubuntu4.2 on Ubuntu 15.10, and 2.23-0ubuntu1 on Ubuntu 16.04 LTS and 16.10, there is a lack of namespace check associated with file-descriptor passing. This allows local users to capture keystrokes and spoof data, potentially gaining privileges.
Multiple integer signedness errors in the opj_j2k_update_image_data function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before version 49.0.2623.87, may allow remote attackers to cause a denial of service or potentially have unspecified other impact via crafted JPEG 2000 data.
In WebKit/Source/core/layout/LayoutObject.cpp in Blink, used in Google Chrome before version 49.0.2623.87, relayout scheduling is improperly restricted, allowing remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted HTML document.
The ImageInputType::ensurePrimaryContent function in Blink, as used in Google Chrome before version 49.0.2623.87, does not properly maintain the user agent shadow DOM, which may lead to denial of service or other unspecified impacts.
The graphite2::TtfUtil::CmapSubtable4NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
The graphite2::TtfUtil::CmapSubtable12Lookup function in Graphite 2 before 1.3.6, used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
The graphite2::Slot::getAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
Heap-based buffer overflow in the graphite2::Slot::setAttr function in Graphite 2 before 1.3.6 allows remote attackers to exploit this vulnerability. This affects Mozilla Firefox before version 45.0 and Firefox ESR 38.x before version 38.7.
The graphite2::GlyphCache::Loader::Loader function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
The graphite2::TtfUtil::CmapSubtable12Lookup function in Graphite 2 before 1.3.6, used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
A heap-based buffer overflow exists in Graphite 2 before version 1.3.6, used in Mozilla Firefox before version 45.0 and Firefox ESR 38.x before version 38.7, in the function graphite2::vm::Machine::Code::Code. This allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Graphite smart font.
The graphite2::FileFace::get_table_fn function in Graphite 2 before 1.3.6, used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for an unspecified data structure. This allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted Graphite smart font.
The graphite2::TtfUtil::CmapSubtable12NextCodepoint function in Graphite 2 before 1.3.6, used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
In Graphite 2 before version 1.3.6, used in Mozilla Firefox before version 45.0 and Firefox ESR 38.x before version 38.7, there is a vulnerability in CachedCmap.cpp. It allows remote attackers to cause a denial of service (buffer over-read) or potentially have unspecified other impact via a crafted Graphite smart font.
The graphite2::Slot::getAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
The graphite2::GlyphCache::glyph function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.