CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.14)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
W funkcji _bfd_elf_slurp_version_tables() w pliku bfd/elf.c wykryto potencjalne przepełnienie bufora oparte na stercie. Może to prowadzić do utraty dostępności.
W cifs-utils przed wersją 6.4 występuje przepełnienie bufora na stosie w plikach cifskey.c lub cifscreds.c, co może umożliwić zdalnym atakującym osiągnięcie nieokreślonego wpływu poprzez nieznane wektory.
Podatność CVE-2016-2781 dotyczy narzędzia chroot w GNU coreutils, które przy użyciu opcji --userspec pozwala lokalnym użytkownikom na ucieczkę do sesji nadrzędnej poprzez spreparowane wywołanie ioctl TIOCSTI, które wprowadza znaki do bufora wejściowego terminala.
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify adbe.pkcs7.sha1 signatures on documents, allowing potential signature forgeries.
Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URLs to be handled by mod_proxy.
Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerable to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable.
Incomplete tracking in PostgreSQL of tables with row security allows reused queries to view or change different rows than intended. Fixes for CVE-2023-2455 and CVE-2016-2193 missed cases involving subqueries, WITH queries, and security invoker views.
Client use of server error messages in PostgreSQL allows an untrusted server under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. A man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql might misinterpret.
A vulnerability in the virtio-gpu module of the Linux kernel involves an incorrect overflow check when allocating 2D images. This flaw can lead to a buffer overflow, potentially enabling privilege escalation or system crash.
Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows than intended. The attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or equivalent. The problem arises when application queries use partitioning.
Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g., PATH). This often suffices for arbitrary code execution, even without a database server OS user account.
Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests.
Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise see.
HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.
Issue in libexpat before version 2.6.4. The XML_ResumeParser function can crash if XML_StopParser stops/suspends an unstarted parser.
Sudo VISudo version 1.6.8 and earlier allows local users to corrupt arbitrary files via a symlink attack on temporary files.
Vulnerability in CUPS printing system versions 2.4.8 and earlier. When starting the cupsd server with a Listen configuration pointing to a symbolic link, the process can perform an arbitrary chmod on the target file.
A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. This may allow an attacker to trigger memory allocation failures, causing a segmentation fault and application crash.
A flaw was found in the OpenJPEG project where a heap buffer overflow condition may be triggered when certain options are specified while using the opj_decompress utility. This can lead to an application crash or other undefined behavior.
A TOCTOU race condition in pg_dump in PostgreSQL allows an object creator to replace another relation type with a view or foreign table, executing arbitrary SQL functions as the user running pg_dump, often a superuser. The attack requires waiting for the right moment.