CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A use-after-free vulnerability in the AppCache implementation in Google Chrome before version 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect pointer maintenance associated with certain callbacks.
A use-after-free vulnerability in the AppCache implementation in Google Chrome before version 47.0.2526.73 allows remote attackers with renderer access to cause a denial of service or possibly have unspecified other impact by leveraging incorrect AppCacheUpdateJob behavior associated with duplicate cache selection.
A use-after-free vulnerability in Google Chrome before version 47.0.2526.73 allows remote attackers to execute arbitrary code or cause a denial of service by mishandling AppCache update jobs.
The BasicJsonStringifier::SerializeJSArray function in json-stringifier.h in the JSON stringifier in Google V8, as used in Google Chrome before version 47.0.2526.73, improperly loads array elements. This allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted JavaScript code.
EMC NetWorker versions before 8.0.4.5, 8.1.x before 8.1.3.6, 8.2.x before 8.2.2.2, and 9.0 before build 407 are vulnerable to denial of service attacks. Remote attackers can cause process outages by sending malformed RPC authentication messages.
Cisco Unified SIP 3905 phones allow remote attackers to cause a denial of service through a large amount of network traffic, leading to resource consumption and functionality loss.
Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the section_offset variable.
Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the start_octet variable.
The index_urlfetch function in Cyrus IMAP versions 2.3.x before 2.3.19, 2.4.x before 2.4.18, and 2.5.x before 2.5.4 allows remote attackers to obtain sensitive information or possibly have unspecified other impact via vectors related to the urlfetch range, which triggers an out-of-bounds heap read.
Off-by-one error in the extracthalf function in the dpkg-deb component in Debian allows remote attackers to execute arbitrary code via the archive magic version number in an 'old-style' Debian binary package, triggering a stack-based buffer overflow.
The Debian build procedure for the smokeping package in wheezy before 2.6.8-2+deb7u1 and jessie before 2.6.9-1+deb8u1 does not properly configure the way Apache httpd passes arguments to smokeping_cgi, allowing remote attackers to execute arbitrary code via crafted CGI arguments.
Cisco IOS XE 15.4(3)S on ASR 1000 devices improperly loads software packages, allowing local users to bypass license restrictions and obtain certain root privileges by entering crafted filenames in the CLI.
Versions of McAfee Enterprise Security Manager (ESM), Enterprise Security Manager/Log Manager (ESMLM), and Enterprise Security Manager/Receiver (ESMREC) before 9.3.2MR19, 9.4.2MR9, and 9.5.0MR8, when configured to use Active Directory or LDAP authentication sources, allow remote attackers to bypass authentication by logging in with the username 'NGCP|NGCP|NGCP;' and any password.
PCRE before 8.38 mishandles certain references, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted regular expression.
PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, allowing remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression.
pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain sensitive information via a crafted file.
PCRE before 8.38 mishandles certain instances of the (?| substring, allowing remote attackers to cause a denial of service (unintended recursion and buffer overflow) or possibly have unspecified other impact via a crafted regular expression.
The pcre_compile function in PCRE before 8.38 mishandles certain [: nesting, which can lead to denial of service (CPU consumption) or other unspecified impacts via a crafted regular expression.
PCRE before 8.38 mishandles the [: and \ substrings in character classes, allowing remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression.
PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, allowing remote attackers to cause a denial of service (infinite recursion) or possibly have unspecified other impact via a crafted regular expression.